Class MemoryPasswordProvider

java.lang.Object
org.apache.logging.log4j.core.net.ssl.MemoryPasswordProvider
All Implemented Interfaces:
PasswordProvider

class MemoryPasswordProvider extends Object implements PasswordProvider
Simple PasswordProvider implementation that keeps the password char[] array in memory.

This implementation is not very secure because the password data is resident in memory during the life of this provider object, giving attackers a large window of opportunity to obtain the password from a memory dump. A slightly more secure implementation is EnvironmentPasswordProvider, and an even more secure implementation is FilePasswordProvider.

  • Field Details

    • password

      private final char[] password
  • Constructor Details

    • MemoryPasswordProvider

      public MemoryPasswordProvider(char[] chars)
  • Method Details

    • getPassword

      public char[] getPassword()
      Description copied from interface: PasswordProvider
      Returns a new char[] array with the password characters.

      It is the responsibility of the caller to erase this data by calling Arrays.fill(char[], char) immediately when authentication is complete and the password data is no longer needed.

      Specified by:
      getPassword in interface PasswordProvider
      Returns:
      a copy of the password
    • clearSecrets

      public void clearSecrets()