Login credentials stored in memory

[andreacastelli1988]

Hi All,

following a security assessment, we noticed that the credentials used during login are kept in memory and are visible if a memory dump is generated.
Is there a way to clean data from component memory?

Thank you
Greetings

[amaitland]

If you are referring to the credentials stored as part of GetAuthCredentials then you should be able to call
http://cefsharp.github.io/api/88.2.x/html/M_CefSharp_RequestContext_ClearHttpAuthCredentials.htm

If the behaviour differs to that of Chrome then it's probably worth discussing improvements on https://magpcss.org/ceforum/index.php

CefSharp is just one of many chromium embedded framework wrappers.

[andreacastelli1988]

It seems that in the memory dump it's possible read urls, parameters and headers of request and response. If i send in http request the credentials, they are stored in memory and this can be a security vulnerability.
In the forum's topics i didn't find any elements related to a possible clean or flush of the memory.
I try to disable caching, but my attempt doesn't work.

[amaitland]

Best to discuss this on https://magpcss.org/ceforum/index.php

[dharmsingh456]

Hi All,

following a security assessment, we noticed that the credentials used during login are kept in memory and are visible if a memory dump is generated. Is there a way to clean data from component memory?

Thank you Greetings

Hi @amaitland
Same issue reported in my application as well . We are using 107 cefsharp version

[amaitland]

If the behaviour reproduces with the current supported version (M124 at time of writing) then you'll need to discuss this on https://magpcss.org/ceforum/index.php