如何处理 MVC 模型的密码字段属性的 Veracode 错误？

Question

I have a model for login logic. It contains a property called Password:

[Required(ErrorMessage = " ")]
[DataType(DataType.Password)]
public string Password { get; set; } 

When Veracode scans the model it produces the following error:

CWE-316: Cleartext Storage of Sensitive Information in Memory

My view is generating the Password field as follows:

@Html.EditorFor(x => x.Password}

Then, along the line in the model, I'm using the following Windows Authentication logic to check if the user is a windows user:

DirectoryEntry de = new DirectoryEntry("LDAP://" + System.Net.NetworkInformation.IPGlobalProperties.GetIPGlobalProperties().DomainName, username, password, AuthenticationTypes.Secure);

The above class' constructor requires password as a string.

What would be the best solution that could fix the Veracode problem and allows me to use the logic I already have?

Answer 1

The solution was an easy one. I just have to change the declaration Password to UserIdnt .

Now Veracode doesn't recognize it as a security threat and let it go