nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

CredentialCache saves password in plain text

Anonymous User

OK so I have the following issue with the CredentialCache. When I access an on premise service the AuthenticationManager CredentialCache automatically adds in my credential, which includes username and password. When I close and reopen my Android application it retains the credential information in the CredentialCache and includes in plain text username and password...

AuthenticationManager.CredentialCache.toJson(); .

I know I can encrypt and store these credentials in a file for use between sessions but I would really like for the CredentialCache to not hang onto these credentials between sessions from a security standpoint.

I would like to have the CredentialCache clear when the application is closed. I know I can add code on the apps OnDestroy event to handle this as follows...

AuthenticationManager.CredentialCache.clear();

This is all well and good, but if the user force closes the application I am not able to clear the cache when the application terminates as I have no event for this (short of creating some sort of convoluted service to listen for a killing of the application).

Just wondering if there is something I am missing here? This seems like a security flaw that is hard to overcome with this implementation.

Finde mehr Beiträge mit dem Tag

Accepted answers

All comments

Anonymous User

OK by getting into the ESRI code this is where the issue seems to be as per the screen grab below...

Anonymous User

I should have mentioned the Context (this) is based off of a FragmentActivity. The example on GitHub uses an AppCompatActivity. Not sure why this would matter, but perhaps this was never tested with a FragmentActivity?

Anonymous User

Thanks for the information Xueming regarding SharedPreferencesCredentialPersistence. I am using the example provided here...

https://github.com/banuelosj/developer-support/blob/master/runtime-android/100.x/shared-preferences-credential-persist/src/main/java/com/example/storecredentials/MainActivity.java

So trying this out I am experiencing a fatal crash every time that I try to set persistence(AuthenticationManager.CredentialCache.setPersistence(spcPersistence);) that appears to be related to the context. Here is my code...

try {
if(mValidLoginCredentials!=null) {
// setting persistance
SharedPreferencesCredentialPersistence spcPersistence = new SharedPreferencesCredentialPersistence(this);
CredentialCacheEntry ccEntry = new CredentialCacheEntry(AuthenticationManager.CredentialCache.toJson(), mValidLoginCredentials);
spcPersistence.add(ccEntry);
AuthenticationManager.CredentialCache.setPersistence(spcPersistence);
}
} catch(Exception e) {
e.printStackTrace();
}

Here is the fatal error I get on setPersistance. If I remove the line setPersistance there is no crash.

java.lang.IllegalArgumentException: Malformed server context

at com.esri.arcgisruntime.internal.e.a.a.m.c(SourceFile:215)
at com.esri.arcgisruntime.internal.e.a.a.m.a(SourceFile:97)
at com.esri.arcgisruntime.internal.m.i.a(SourceFile:133)
at com.esri.arcgisruntime.internal.m.i.b(SourceFile:556)
at com.esri.arcgisruntime.internal.m.i.lambda$Ot9dfO0N49gef9HDOrvF0DHIi4Y(Unknown Source:0)
at com.esri.arcgisruntime.internal.m.-$$Lambda$i$Ot9dfO0N49gef9HDOrvF0DHIi4Y.run(Unknown Source:2)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
at java.lang.Thread.run(Thread.java:919)

XuemingWu

Hi Aaron,

It is indeed a flaw if the CredentialCache which stores credentials in-memory retains credentials information after an app is closed or forced closed. In our testing the CredentialCache was cleared out when an app was closed and reopened again. We may miss some workflow though. So, could you share your workflow or maybe some code snippets with us so that we can investigate.

We are ware of the security risks and concerns of storing credentials in plain texts. We introduced a new class called SharedPreferencesCredentialPersistence which encrypts and stores credentials in SharedPreferences file in 100.9.0. We also plan to provide a default implementation to persist credential cache to a secured storage which should be encrypted in the future.

Thanks,

Nimm an der Unterhaltung teil

Angemeldete Mitglieder können Beiträge verfassen, Updates folgen und mehr. Neu hier? Registriere ein kostenloses Konto.

Schnellzugriffe

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.