密码存储在谷歌浏览器的浏览器内存中

Question

当我从应用程序登录和注销时，我的用户名和密码存储在chrome浏览器的内存中。当我从任务管理器为该特定进程ID创建转储文件并在WinHex工具中打开该文件并搜索用户名或密码字段时，我可以看到明文密码，现在我想加密或清除该密码字段。

function onLogin(btnName) {
    var parameters = getFormValues();

    //if (!validateParameter(parameters.userName, parameters.password))
    //    return;

    $.ajaxSetup({
        beforeSend: function (xhr) {
            xhr.setRequestHeader(parameters.antiForgeryTokenName, parameters.antiForgeryToken);
        }
    });
    var getSecuritySettingsUrl = getVirtualDirectoryUpdatedURL("/login/GetSecuritySettings");
    $.ajax({
        url: getSecuritySettingsUrl,
        type: "GET",
        contentType: 'application/json; charset=utf-8',
        success: function (result) {
            try {
                var response;
                if (result.IsHashed) {
                    var decryptedData = decryptWithDefaultSetting(result.viewData);
                    if (decryptedData.isError) {
                        alert(decryptedData.result);
                        return;
                    }
                    response = JSON.parse(decryptedData.result);
                }
                else {
                    response = JSON.parse(result.viewData);
                }

                if (response.IsPasswordHashed) {
                    if (isNullOrUndefined(response.SaltText)) {
                        throw new Error("Please refresh the page and try again");
                    }
                    encriptPass = encryptByInputKey(parameters.form["Password"].value, response.SaltText).result;
                }
                $('#btnType').val(btnName);
                $('form input[name="Password"]').val(encriptPass);
                $('#loginForm').submit();
            } catch (error) {
                console.log(error);
                if (!isNullOrUndefined(error)) {
                    if (!isNullOrUndefined(error.message)) {
                        alert(error.message);
                    }
                    else if (!isNullOrUndefined(error.Message)) {
                        alert(error.Message);
                    }
                    else {
                        alert("Some error has occurred. Please refresh the page and try again");
                    }
                }
            }
        },
        error: function (xhr, textStatus, error) {
            console.log(xhr);
            alert("Please refresh the page and try again : " + xhr.statusText);
        }
    });
}

Answer 1

我通过在用户界面中对用户输入的密码进行加盐和哈希处理并将加盐的值和哈希值都传递给服务器进行身份验证，从而解决了该问题。在服务器端密码验证期间必须应用相同的符号。