title: Checkmarx heap inspection vulnerability WebAPI
body: <p>I've built an ASP.NET WebAPI 2 application and one of my controllers have a method that allow users do login, <strong>something like this:</strong></p>
  
  <pre><code>[Route("login")]
  [HttpPost]
  [SwaggerOperation(Tags = new[] { "ACCOUNT" })]
  [SwaggerResponse(HttpStatusCode.OK, Type = typeof(ReturnModel&lt;AccountModel, HttpStatusCode&gt;))]
  public HttpResponseMessage Login([FromBody]LoginDto userData)
  {
     ReturnModel&lt;AccountModel, HttpStatusCode&gt; returnObj = new ReturnModel&lt;AccountModel, HttpStatusCode&gt;();
  
     try
     {
        returnObj = accountService.Login(userData.UserLogin, userData.UserPassword);
  
        if (returnObj.Success)
        {
           ...
        }
        else 
        {
           ...
        }
  
        return Request.CreateResponse(returnObj.StatusCode, returnObj);
     }
     catch (Exception ex)
     {
        LogUtil.Error(ex);
        return Request.CreateResponse(HttpStatusCode.InternalServerError, returnObj);
     }
  }
  </code></pre>
  
  <p><strong>LoginDto class:</strong></p>
  
  <pre><code>public class LoginDto
  {
     [Required]
     public string UserLogin { get; set; }
  
     [Required]
     public string UserPassword { get; set; }
  }
  </code></pre>
  
  <p>After a vulnerability check with Checkmarx tool, i received a report that says:</p>
  
  <blockquote>
    <p>Method Index at line 55 of
    <strong><em>/</em></strong>/***/Controllers/AccountController.cs
    defines UserPassword, which is designated to contain user passwords.
    However, while plaintext passwords are later assigned to UserPassword,
    this variable is never cleared from memory.</p>
  </blockquote>
  
  <p>I know that strings are immutable and stays in memory for an undetermined time.</p>
  
  <p>The tool (checkmarx) have a suggestion that says:</p>
  
  <blockquote>
    <p><strong>Specific Recommendations - .NET:</strong></p>
    
    <p><strong><em>- Instead of storing passwords in immutable strings, prefer to use an encrypted memory object, such as SecureString or ProtectedData.</em></strong></p>
  </blockquote>
  
  <p>I found other suggestions that also say me to use <strong>SecureString</strong> instead <strong>string</strong> to manipulate/store user passwords, but i think that this only applies to MVC or WPF applications, i can't figure out how can i apply this on an ASP.NET WebAPI 2 context, where i have to expose a language agnostic service.</p>
  
  <p>Anyone have any suggestion about how can i achieve this level of security (or even if it's possible) on an ASP.NET WebAPI 2?</p>