spring-projects / spring-projects/spring-security
SEC-2775: API design misconception in UserDetailsManager#changePassword
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Christian Rudolph (Migrated from SEC-2775) said:
There is a misconception in the UserDetailsManager interface. The signature of changePassword is
void changePassword(String oldPassword, String newPassword)
This makes it impossible to clear the passwords from memory after someone has changed his password. The passwords should be given as char[] or at least CharSequence s, but a change is not possible without API break.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the UserDetailsManager#changePassword entry point and review its String-based oldPassword and newPassword parameters. Determine an implementable API direction that addresses clearing passwords from memory while accounting for the stated API-break constraint; done means the design and compatibility impact are resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100