安全地处理servlet中的密码

Question

I am transmitting a password through HTTP(S) to a HttpServlet as parameter. To get the password I am using the Servlets getParameter(String) method, which returns a String. But passwords should be handled with char[] like mentioned here .

Well, what I want to know is: How can I process a password securely within a Java Servlet? Is my solution with getParameter(String) the only one or are there better options?

Please keep in mind that I am NOT interested in how to transmit a password securely (I am expecting that the transmit is secure - maybe with SSL or something else).

Thanks in advance :)

Edit: I forgot to mention that I am not using the password myself (for some kind of access restrictions for my application). I am just forwarding the password (so you could say my WebApp is something like a remote control).

Answer 1

If your login parameter is sent in a POST request and contained in the request content you could parse the content yourself and put the password in a char array.

You need to do this before any call to request.getParameter(String) is made since this will make the container read and parse the content. This only works if the servlet container lazily initializes its parameter map.

Answer 2

"Teleporter" approach:

Have Javascript break the password into parameters of 1 character each. Reassemble directly into char array at server side.