Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[IMPROVEMENT] Utilize char array for storing and handling the Vault token #64

Open
jon5477 opened this issue Dec 1, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@jon5477
Copy link

jon5477 commented Dec 1, 2024

Is your feature request related to a problem? Please describe.
According to the official Java Cryptography Architecture, you should not use String for storing the Vault token but instead use char[] to safely and securely handle security-sensitive information.

This feature makes String objects unsuitable for storing security-sensitive information such as user passwords. You should always collect and store security sensitive information in a char array instead.

Describe the solution you'd like
Internal handling of the token as a char[] and passing directly to the HTTP header X-Vault-Token. I know the restriction is that the HTTP header code only accepts a String, for this case it is acceptable to use new String(...) and pass in the char[] token because the String will be short-lived and not passed to other areas of the application.

Describe alternatives you've considered
I know a lot of legacy code may utilize the String as a token, therefore I suggest utilizing CharSequence to maximize legacy code compatibility as people slowly transition to using char[]. I propose providing 2 methods on the VaultConfig class to maximize compatibility:

public void setToken(CharSequence token) {
// store token
}

public void setToken(char[] token) {
// store token
}

Additional context
I've made some of those changes on my forked branch already, you can view those changes here.

@jon5477 jon5477 added the enhancement New feature or request label Dec 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant