title: What are the security implications of storing passwords in Javascript variables?
body: <p>I'm developing a web app which needs good security. In the present design, a number of user actions need the user to re-send their password (or else the server will have to store it in plain text, at least temporarily).</p>
  
  <p>Much user interaction happens through AJAX requests. Rather than have the user re-type the password for each, I'd like to do something like this:</p>
  
  <pre><code>var password_plain = document .getElementById ("password") .value;
  
  ajax ("/login.php", {password: password_plain, username: ...});
  
  // later
  
  ajax ("/api.php", {password: password_plain, action: ...});
  </code></pre>
  
  <p>Assume for the sake of the argument that the design is sensible in general, for example</p>
  
  <ul>
  <li><p>the server does not store or leak the plain text password,</p></li>
  <li><p>SSL is properly set up</p></li>
  <li>the client Javascript periodically checks that we are still logged in and sets <code>password_plain=null</code> if the session expires (and clears the DOM value)</li>
  <li>the server itself is secure</li>
  </ul>
  
  <p>The threat model is that the attacker doesn't have physical access to either the client or server machine, and cannot run arbitrary code on either, but can entice the user to visit malicious other web pages in the client's browser.</p>
  
  <p>Is the password safe in a javascript variable?</p>