[KAFKA-17014] ScramFormatter should not use String for password.

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: security
• Assignee: dujian0068
• Reporter: Tsz-wo Sze
• Created: 21/Jun/24 05:52
• Updated: 22/Jun/24 14:00

Description

Since String is immutable, there is no easy way to erase a String password after use. We should not use String for password. See also https://stackoverflow.com/questions/8881291/why-is-char-preferred-over-string-for-passwords