I am working on a tool that makes use of the Tooling API and the Partner API. The Partner API is used to login as I have been unable to login successfully via the Tooling API. Another important thing to note is that this tool is being built in Java. What I noticed was that whether I attempt to login via the Connector.newConnection() method with a ConnectorConfig object or call login() on an instance of the PartnerConnection class, it uses a String object instead of a char[] for both the password and the security token. This would end up with the user's password and security token combination being stored in the JVM's String pool and would pose a security risk. Is there a way to login with a char[] or a byte[] for the password and the security token instead of a String?

  • 6
    There is a really good discussion about string vs char[] in Why is char[] preferred over String for passwords?. Personally, I'm of the school that if your machine has been so badly compromised that someone is tampering with your memory then you have much bigger problems. Dec 2, 2013 at 18:56
  • That said, maybe you need to use a different tool to generate the Java proxy classes from the WSDLs? Note, it isn't just the password and security token you need to worry about. The resulting SessionId is just as sensitive and you need to keep that around to send with each subsequent request. You are not going to be able to put that in a char[] and then clear it immediately to reduce the window that someone else might read it. Dec 2, 2013 at 19:00
  • That's a good point, thanks for your input. As this is really only going to be an internal tool anyways and all of the machines it will be running on are well maintained and protected, I agree it most likely won't ever need this extra layer of security. The login information that is stored on the drive is encrypted before being stored as is, so that's most likely all that's needed. After looking through some of the Tooling API's source, it appears that sensitive data is stored in String format throughout anyways, requiring much more work and making it much less worth it to implement this.
    – jsnbdly
    Dec 2, 2013 at 21:15


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.