application-security

This question already has an answer here: When would I need a SecureString in .NET? 11 answers So the .NET framework provides the SecureString class for storing strings in a secure fashion. But to read the information and work with it you have to return it to a standard string. See this implementation example . As you can see from the example using the pointer we return an unencrypted string. How to do we now manage that "insecure" instance of the string? What is the most secure way to work with the value once it has been set? Edit The purpose of this question was to discuss methods to REDUCE

In Implicit Grant, the access token is sent back in the callback URL. Is this not a security risk because, if this callback URL is cached in the hop. In general it is advised, not to send sensitive data in URL params, and this access token will be a token to access all secured user resources. So why is it getting passed as fragment in URL Elaborating on @vlatko's response... To mitigate the risk of sending the token in the fragment (or via any other OAuth2 grant): ensure that the OAuth endpoint and the callback endpoint are TLS (https) (See countermeasures ) send a state parameter to prevent