密码存储在谷歌浏览器的浏览器内存中

Question

When I login and logout from my application, my username and password are stored into chrome browser memory. When I create a dump file from the task manager for that particular process Id and open that file in WinHex tool and search for username or password field I'm able to see my password in clear text and now I want to encrypt or clear that password field.

function onLogin(btnName) {
    var parameters = getFormValues();

    //if (!validateParameter(parameters.userName, parameters.password))
    //    return;

    $.ajaxSetup({
        beforeSend: function (xhr) {
            xhr.setRequestHeader(parameters.antiForgeryTokenName, parameters.antiForgeryToken);
        }
    });
    var getSecuritySettingsUrl = getVirtualDirectoryUpdatedURL("/login/GetSecuritySettings");
    $.ajax({
        url: getSecuritySettingsUrl,
        type: "GET",
        contentType: 'application/json; charset=utf-8',
        success: function (result) {
            try {
                var response;
                if (result.IsHashed) {
                    var decryptedData = decryptWithDefaultSetting(result.viewData);
                    if (decryptedData.isError) {
                        alert(decryptedData.result);
                        return;
                    }
                    response = JSON.parse(decryptedData.result);
                }
                else {
                    response = JSON.parse(result.viewData);
                }

                if (response.IsPasswordHashed) {
                    if (isNullOrUndefined(response.SaltText)) {
                        throw new Error("Please refresh the page and try again");
                    }
                    encriptPass = encryptByInputKey(parameters.form["Password"].value, response.SaltText).result;
                }
                $('#btnType').val(btnName);
                $('form input[name="Password"]').val(encriptPass);
                $('#loginForm').submit();
            } catch (error) {
                console.log(error);
                if (!isNullOrUndefined(error)) {
                    if (!isNullOrUndefined(error.message)) {
                        alert(error.message);
                    }
                    else if (!isNullOrUndefined(error.Message)) {
                        alert(error.Message);
                    }
                    else {
                        alert("Some error has occurred. Please refresh the page and try again");
                    }
                }
            }
        },
        error: function (xhr, textStatus, error) {
            console.log(xhr);
            alert("Please refresh the page and try again : " + xhr.statusText);
        }
    });
}

Answer 1

I have solved this problem earlier by salting and hashing the user entered password in the UI and passing both the salted value and hash to server for authentication. The same salt has to be applied during the server side password validation.