Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MFXPasswordField extends regular TextField #187

Open
M-K-Al opened this issue Apr 26, 2022 · 3 comments
Open

MFXPasswordField extends regular TextField #187

M-K-Al opened this issue Apr 26, 2022 · 3 comments
Labels
to-evaluate To understand if it's worth it, or More info needed, or More investigation needed

Comments

@M-K-Al
Copy link

M-K-Al commented Apr 26, 2022

MFXPasswordField returns passwords as Strings which is insecure. Please refer to this answer for more details.

@Tech-Expert-Wizard
Copy link

Tech-Expert-Wizard commented Apr 26, 2022

@M-K-Al So is the same for the JavaFX PasswordField. I'm going to see if I can submit a pull request for this. In the meantime, if you really need a secure option, then use Swing's JPasswordField.
EDIT: It's actually really hard to make a secure PasswordField without making major rewrites of the JavaFX PasswordField. You could file a feature request to the JavaFX devs though. @palexdev I think this can be closed.

@palexdev
Copy link
Owner

@M-K-Al the JavaFX's PasswordField does the same. I don't think it's responsibility of the UI element but rather the user.
Maybe you should convert the returned String to a char[]

Also note that even if JPasswordField offers a method to return the text as a char[] there still are methods that return String (even if deprecated they are there)
Plus, the getPassword() which returns the char[] simply gets the text and converts it to char[]
Security has little to do with UI

So, either I add a similar method but the implementation remains the same or I just ignore this.
I'll have to think about this

@palexdev palexdev added the to-evaluate To understand if it's worth it, or More info needed, or More investigation needed label Apr 26, 2022
@stale
Copy link

stale bot commented May 24, 2022

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale label May 24, 2022
@palexdev palexdev removed the stale label May 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
to-evaluate To understand if it's worth it, or More info needed, or More investigation needed
Projects
None yet
Development

No branches or pull requests

3 participants