You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Feature:
Currently application takes plain text passwords in variables and keeps them as is during the lifecycle of application. This has security issue where passwords will be revealed during heap dump.
Note: this issue is related to application related secrets only.
Solution:
Use spring password encoders wherever secrets are involved and decode them for temporary use where applicable and clear them / they get cleared due to variable scope completion.
Feature:
Currently application takes plain text passwords in variables and keeps them as is during the lifecycle of application. This has security issue where passwords will be revealed during heap dump.
Note: this issue is related to application related secrets only.
Solution:
Use spring password encoders wherever secrets are involved and decode them for temporary use where applicable and clear them / they get cleared due to variable scope completion.