使用Spark Java（webserver）从内存中删除敏感数据

Question

I'm using SparkJava and I'm conserned when dealing with Passwords. The idea is to pass the password (in plain text) to the server (under https obviously), then hash and salt server side, and store the salt and hash on the server for the user. However according to this post the plain text password should never be stored as a String in memory for security reasons.

However when accessing the http protocol body from a POST request using SparkJava, the API returns a String, which has the plaintext password.

Route post = (request, response) -> {
    String dataWithPassword = request.body();
    //     ^-- Stays in memory until GC kicks in 
}

How should I do to make sure that the plaintext password that was received from a client is not stored as a String serverside, so this might never be a potential security hole? Or is there something else I can do to make sure that the memory is cleared and the plaintext password doesn't linger in memory?

Answer 1

The way you are doing it's already guaranteed that this password will never be stored in a file, like a server log. But in Java there's no official way to clear the memory. There's nothing you can do to guarantee that the memory that holds the plain text password is cleared. You could even set the reference dataWithPassword to null and call System.gc() which suggest that now is a good time to run the garbage collector, but it would not be guaranteed to get that memory cleared. I see that a possible security issue in your approach is to send the password in plain text from the client to the server, even by using https (I strongly not suggest this). The best thing you could do is to require the client o give you the password already encrypted, so that you wouldn't need to worry about this value in memory and you're going to get a lot more safety cause network sniffers and proxies would not now what the password is.