Xbase++

Set the FTP Password from a SecureString

Demonstrates the Chilkat Ftp2.SetSecurePassword method, which sets the login password from a SecureString. The only argument is the SecureString. It is equivalent to setting the Password property but avoids holding the password as an ordinary immutable string.

Background: An ordinary string password can linger in memory (and in memory dumps) because strings are immutable and copied freely. A SecureString keeps the value encrypted under a session key and clears it deterministically, reducing that exposure — a sensible upgrade for a credential the process holds for the life of the connection. Populate it from a runtime source rather than a hard-coded literal.

Chilkat Xbase++ Downloads

Download Chilkat for Xbase++

Xbase++

LOCAL nSuccess
LOCAL oFtp
LOCAL cPassword
LOCAL oSecurePassword

nSuccess := 0

//  Demonstrates the Ftp2.SetSecurePassword method, which sets the login password from a
//  SecureString.  The only argument is the SecureString.  This avoids holding the password as an
//  ordinary immutable string.

oFtp := CreateObject("Chilkat.Ftp2")

oFtp:Hostname := "ftp.example.com"
oFtp:Username := "myFtpLogin"

//  Normally you would not hard-code the password in source.  You should instead obtain it
//  from an interactive prompt, environment variable, or a secrets vault.
cPassword := "myPassword"

//  Place the password into a SecureString, which keeps it encrypted in memory.
oSecurePassword := CreateObject("Chilkat.SecureString")
oSecurePassword:Append(cPassword)

//  Setting the secure password is equivalent to setting the Password property, but more
//  protective.
nSuccess := oFtp:SetSecurePassword(oSecurePassword)
IF (nSuccess == 0)
    ? oFtp:LastErrorText
    oFtp:destroy()
    oSecurePassword:destroy()
    RETURN
ENDIF

nSuccess := oFtp:Connect()
IF (nSuccess == 0)
    ? oFtp:LastErrorText
    oFtp:destroy()
    oSecurePassword:destroy()
    RETURN
ENDIF

? "Connected using a secure password."

nSuccess := oFtp:Disconnect()
IF (nSuccess == 0)
    ? oFtp:LastErrorText
    oFtp:destroy()
    oSecurePassword:destroy()
    RETURN
ENDIF

oFtp:destroy()
oSecurePassword:destroy()