最佳安全做法是不要将密码存储在不可变的字符串中，而使用加密的内存对象（如SealedObject）。此专用类可以将加密的数据存储在内存中，并帮助确保无法从内存中轻松检索这些数据。

@PutMapping(path = "/changepassword", produces = APPLICATION_JSON_VALUE)
public ResponseEntity<String> changePassword(@RequestBody UserUpdate user, HttpServletRequest request, HttpServletResponse response)  {
    String uid= user.getId();
    SealedObject oldPassword = user.getOldPwrd();
    SealedObject newPassword = user.getPwrd();
    userDetails.changeUserPassword(uid, oldPassword, newPassword);
    return ResponseEntity.ok(SUCCESS);
}

您必须更改changeUserPassword方法以处理SealedObject，这涉及到定义加密密码和密钥：

Key key = getKeyFromConfiguration();
Cipher c = Cipher.getInstance(CIPHER_NAME);
c.init(Cipher.ENCRYPT_MODE, key);
List<Character> characterList = Arrays.asList(input);
password = new SealedObject((Serializable) characterList, c);
Arrays.fill(input, '\0');