Why not DriverManager.getConnection(String url, String user, char[] password)?
char, java, security, string
Solution
String literals go in a pool, but I wouldn't expect the password to be a literal (hardcoded in the program). I would expect it to come from a configuration or similar. As such it won't be a literal and will get garbage collected (provided all references are binned).
Problem
We know it's a good practice to prefer char[] over java.lang.String to store passwords. That's for the following two reasons (as I have read): - char[] are mutable so we can clear the passwords after the usage. - String literals goes to a pool that will not get garbage collected as other objects, hence might appear in memory dumps. But java.sql.DriverManager doesn't have a getConnection() that comply with the above best practice because its password parameter is String. DriverManager.getConnection(String url, String user, String password) I think the API should have an overloaded method with the following signature: DriverManager.getConnection(String url, String user, char[] password) What do you think about this? Do you see any alternative way to overcome this draw back? Would love to hear your thoughts.