Class MemoryPasswordProvider

  • All Implemented Interfaces:
    PasswordProvider

    class MemoryPasswordProvider
    extends java.lang.Object
    implements PasswordProvider
    Simple PasswordProvider implementation that keeps the password char[] array in memory.

    This implementation is not very secure because the password data is resident in memory during the life of this provider object, giving attackers a large window of opportunity to obtain the password from a memory dump. A slightly more secure implementation is EnvironmentPasswordProvider, and an even more secure implementation is FilePasswordProvider.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private char[] password  
    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      void clearSecrets()  
      char[] getPassword()
      Returns a new char[] array with the password characters.
      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Field Detail

      • password

        private final char[] password
    • Constructor Detail

      • MemoryPasswordProvider

        public MemoryPasswordProvider​(char[] chars)
    • Method Detail

      • getPassword

        public char[] getPassword()
        Description copied from interface: PasswordProvider
        Returns a new char[] array with the password characters.

        It is the responsibility of the caller to erase this data by calling Arrays.fill(char[], char) immediately when authentication is complete and the password data is no longer needed.

        Specified by:
        getPassword in interface PasswordProvider
        Returns:
        a copy of the password
      • clearSecrets

        public void clearSecrets()