Is there any benefit to using SecureString in ASP.NET?

by

As you correctly deduced, and others already mentioned, it makes little sense to use SecureString to store security-sensitive data that comes from an ASP.NET form, because that data is already present in memory in plain text.

There are other scenarios, however, where the use of SecureString is recommended, because the sensitive data is created by the program itself and should not remain in memory after it’s done working with it. For instance, creating a SharePoint site programmatically, or transferring authentication credentials from one system to another.

Back in the good old days, it was easier to ensure that the lifetime of sensitive data was as short as possible. It could be allocated on the stack and cleared as soon as the program was done using it:

char secret[512];
generate_secret(secret, sizeof(secret));
do_something_with(secret);
memset(secret, 0, sizeof(secret));
// Secret data is now gone.

Such an approach is not possible with managed strings, though, mainly because:

  • They’re not allocated on the stack,
  • They’re immutable, so they cannot be cleared,
  • They’re not disposable, so there is no guarantee about the time when the GC will free the data. It might even never be freed, depending on memory conditions.

SecureString tries to solve that problem by being mutable and disposable, which allows one to write:

using (SecureString secret = new SecureString()) {
    GenerateSecret(secret);
    secret.MakeReadOnly();
    DoSomethingWith(secret);
}
// Secret data is now gone.

More Related Contents:

  1. How do I get the contents of a JSON file I added in the StartUp method to use it in one of my actions?
  2. Search SQL by date ASP.NET
  3. How to Convert JSON object to Custom C# object?
  4. The request was aborted: Could not create SSL/TLS secure channel
  5. How to use __doPostBack()
  6. Can’t get Czech characters while generating a PDF
  7. Object cannot be cast from DBNull to other types
  8. Configure the authorization server endpoint
  9. How to get values of selected items in CheckBoxList with foreach in ASP.NET C#?
  10. How do you programmatically fill in a form and ‘POST’ a web page?
  11. How to Get IP Address?
  12. How to check a input IP fall in a specific IP range
  13. What is the difference between PreserveReferencesHandling and ReferenceLoopHandling in Json.Net?
  14. Async Void, ASP.Net, and Count of Outstanding Operations
  15. HttpContext.Current.Session is null when routing requests
  16. Declaration of Anonymous types List [duplicate]
  17. Cannot deserialize the current JSON array (e.g. [1,2,3]) into type
  18. Check if datetime instance falls in between other two datetime objects
  19. How to use custom Authorize attribute for roles as well as a specific user?
  20. How to Kill A Session or Session ID (ASP.NET/C#)
  21. What does N’ stands for in a SQL script ? (the one used before characters in insert script)
  22. get date part only from datetime value using entity framework
  23. ASP.NET ODBC Query with parameters
  24. Read excel file from a stream
  25. On postback, how can I check which control cause postback in Page_Init event
  26. sending mail along with embedded image using asp.net
  27. How can I add an ampersand for a value in a ASP.net/C# app config file value
  28. Share Session between two web sites using asp.net and state server
  29. Access resx resource files from another project
  30. GoogleWebAuthorizationBroker.AuthorizeAsync Hangs

Leave a Comment