Secure input for requesting passwords from user input.

[hcldan]

Is your feature request related to a problem? Please describe.
I'd like to do all I can to keep user passwords out of memory as soon as possible after being collected.
Ideally, I could use a Buffer and zero-out the memory after I use it... assuming that I never turn it into a string and only read it from the Buffer. I'm not 100% sure that even that mitigation will prevent the memory from being copied around by the VM... but I guess that's part of this feature request.

Describe the solution you'd like
The readline module allows you to read an input stream, but the events return strings instead of buffers... It would be nice if there were a method that could take a buffer for holding passwords from user input.

[bnoordhuis]

The way Node.js reads asynchronously from the TTY (or any stream device) doesn't lend itself well to reading into a preallocated buffer. It's not completely impossible, but it is an awkward fit.

Perhaps a better solution is a readline.readPassphrase() method that makes some guarantees about the result, i.e., that it's a buffer that's mlock-ed into non-pageable memory, that it's zeroed on garbage collection, etc.

[hcldan]

I believe that would fit my needs.

[hcldan]

A SecureBuffer class (or maybe even a SecureString class or internal) that has that behavior would also be great for handling sensitive information like keys and such.

If GC could happen immediately for just those types of objects, it could help so that I don't have to use buffers and avoid the unnatural interaction with streams.

[BridgeAR]

Related: #30956

[github-actions]

There has been no activity on this feature request for 5 months and it is unlikely to be implemented. It will be closed 6 months after the last non-automated comment.

For more information on how the project manages feature requests, please consult the feature request management document.

[hcldan]

I would still really like this please.

[github-actions]

There has been no activity on this feature request for 5 months and it is unlikely to be implemented. It will be closed 6 months after the last non-automated comment.

For more information on how the project manages feature requests, please consult the feature request management document.

[github-actions]

There has been no activity on this feature request and it is being closed. If you feel closing this issue is not the right thing to do, please leave a comment.

For more information on how the project manages feature requests, please consult the feature request management document.