java - Issue establishing a database connection with a char array instead of a String -

as title says, i'm looking finding way use char[] array establish jdbc connection instead of creating new string object char[] array , using establish connection.

because char[] arrays more secure strings in java, i've been wanting keep things secure possible when dealing jpasswordfields.

in particular case, i'm taking char[] array contents of jpasswordfield , attempting establish jdbc connection database. works well, i'm having create new string object char[] array call getconnection method.

is there way ensure at-least security doing this, or forced create string object , continue on using in method?

this code:

/**  * construct new datamanager object it's own  * connection database.  *  * @param ipaddress ip address server on mysql running.  * @param port port use when connecting mysql.  * @param databasename database name of database connect to.  * @param username username mysql account access specified database.  * @param password password mysql account specified specified username.  */ public datamanager(final string ipaddress, final string port, final string databasename, final string username, final char[] password) throws classnotfoundexception, illegalaccessexception, instantiationexception, sqlexception {     class.forname("com.mysql.jdbc.driver").newinstance();     string url = "jdbc:mysql://" + ipaddress + ":" + port + "/" + databasename + "?noaccesstoprocedurebodies=true"; //?noaccesstoprocedurebodies=true required using stored procedures.     dbconnection = drivermanager.getconnection(url, username, new string(password)); } 

sorry formatting, lines bit long , wrap.

here's java docs drivermanager class i'm using. i've checked , there doesn't seem method use char[] instead of string , that's prompted post.

thanks help/tips.

as @davids said in comments, i'm not sure using char[] more secure in meaningful way, did dig the drivermanager source see if possible use anyway.

if @ the getconnection() method you're using you'll see (along other parameter variations) collecting provided connection information in java.util.properties, string->string hash table. properties object passed needed driver on method that's defined part of long standing (and unlikely change) java.sql.driver interface, implementation of dependent on driver.

at point think have automatically assume somewhere either make copy of supplied password string or include in composition of bigger string, , can't rely on reflection go , clear out buffer. example, in postgresql jdbc driver, depending on authentication settings password may sitting out encoded byte[] , settings digest still possibly (i haven't looked extensively, , i'm not trying knock postgresql here) leave digest open being dug up.

even if no 1 ever made copy of password string , digest untouchable, still have worry fact there dangling references (through properties object) on driver's stack, , things might break in unexpected ways.

for better or worse, think we're pretty committed storing db passwords strings @ point, i'm not convinced it's big issue. don't think historical experience has been it's easier programmers securely manage life-cycle of sensitive objects opposed garbage collector. it'd nice if java gave way annotate object target more aggressive pruning, not necessary.

just writing post, had go through ~8 levels of method calls , object creation , wonder if password string short-lived enough being able manually wipe decrease attack surface area. think convenience ergonomics of java's db handling lets forget how going on behind scenes.