cleanup password after each login attempt

[gdlx]

I've noticed that after a logout or unsuccessful login attempt, the password field wasn't empty when going back to the login page.

I think it is unsecure to keep the password in memory after a login attempt so I submit this PR that just cleanup the password variable (and bound form input).

[marcoow]

maybe better set to undefined

[marcoow]

sounds good; can you fix the build and add a test case?

[gdlx]

I'm not comfortable with PhantomJS testing yet and I can't run tests locally.

bundle exec rake test hangs here:

# bundle exec rake test
Building Ember.SimpleAuth...
Done
which phantomjs > /dev/null 2>&1
Git Support Debugging Info:
  commit_range: c0efa9f0d52985060508b1fd3aa05ee5ee05b349...c0efa9f0d52985060508b1fd3aa05ee5ee05b349
  current_tag:
  current_branch: clean-password
  current_revision: c0efa9f0d52985060508b1fd3aa05ee5ee05b349
  commits: {}
Running tests on master
Puma 2.6.0 starting...
* Min threads: 0, max threads: 16
* Environment: development
* Listening on tcp://0.0.0.0:60099

Running: {"package":"all"}

Any idea ?

[marcoow]

Hm, do you have PhantomJS installed? Also you could try running

bundle exec rackup

from the repository root and then open the URL it prints out in the browser and run the specs there.

[gdlx]

That's ok. I was using phantomjs installed by npm. Using the website bin works fine.

[gdlx]

About the broken test, I really don't understand why the overriden tokenRequestOptions isn't called anymore when clearing the password variable.

Could I clear the variable anywhere in the login action, the default tokenRequestOptions will be called instead of the overridden one in the test...

Did you already meet this behavior ?

[marcoow]

The problem is that password is set to undefined when login is called the first time in line 54 and then wham it's called the 2nd time in line 67 it's still undefined and nothing actually happens as

if (!Ember.isEmpty(data.identification) && !Ember.isEmpty(data.password)) {
  ...

is false. You'd need a

testController.set('password', 'password');

before the 2nd invocation.

Also, it would be better to only unset password inside of the if block.

[gdlx]

I've seen you've made the change.

Thank you ! (I'll delete the branch).