Hi Navaneet,
Got it, I think it may not be solvable on CXF side. There are many layer in
between, f.e. JAXB parsers.
Probably the simplest solution would be to not store passwords in clean text in
XML but rather use encyption.
In this case you would have the extact place in the code to decrypt the
password and clean up the buffers right
after. Not sure if it is possible in your case. Thanks.
Best Regards,
Andriy Redko
KN> Hi Andriy:
KN> Thanks for the quick response.
KN> OWASP has general ideas about storing the password and that is where this
requirements on wiping out password comes
KN> from, but my question was specific to Apache CXF and XML Schema:
KN> How do I get Apache CXF to work in a way that the framework never uses Java
String, an immutable object whose
KN> memory cannot be accessed by the client, to marshall/unmarshall passwords
and other secrets?
KN>
KN> Nav
KN>
KN> Sent from Mail for Windows 10
KN>
KN> From: Andriy Redko <[email protected]>
KN> Sent: Tuesday, September 4, 2018 7:45:35 PM
KN> To: Kumar, Navaneet; [email protected]
KN> Subject: [External] Re: How to wipe out passwords and keys
KN> Hi Navaneet,
KN> The OWASP has a dedicated page related to storing password securily:
KN> https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet. Is it
helpful? Thank you.
KN> Best Regards,
KN> Andriy Redko
KN> Tuesday, September 4, 2018, 10:47:56 AM, you wrote:
KN>> We have a security requirement where we must not leave passwords and other
secrets in memory for long. We must
KN>> “wipe-out” such secrets in memory as soon as we are done with using them.
KN>> Passwords are currently modeled as an “xsd:string” in our system resulting
in a Java String class to manipulate them.
KN>> Java String is immutable in that there is no way to write spaces or other
characters to the memory used by this object after we are done with it.
KN>> I don’t see a way to use say a character array to bind passwords.
KN>> Has anyone else come across this issue? What is the recommended approach?
KN>> Thanks
