🔴 CRITICAL: Fix password storage vulnerability (CWE-312) #1263

[Harshit2405-2004]

🔴 CRITICAL Security Fix

Fixes #1263 - Plain-text Password Storage Vulnerability (CWE-312)

---

📋 Summary

This PR removes password storage from the global Zustand state to fix a critical security vulnerability where user passwords were exposed in browser memory and React DevTools.

🔒 Security Impact

Before (Vulnerable)

• ❌ Passwords stored indefinitely in global userStore
• ❌ Visible in React DevTools to anyone with browser access
• ❌ Accessible through memory inspection
• ❌ Persisted if store used persistence middleware
• ❌ Violated OWASP A02:2021 (Cryptographic Failures)

After (Secure)

• ✅ Passwords NEVER stored in global state
• ✅ Ephemeral storage only during TOTP flow (~seconds)
• ✅ Automatic cleanup on success/error/modal close
• ✅ No exposure in React DevTools
• ✅ Follows security best practices

---

🔧 Changes Made

1. Removed Password from Global State

Files:

• packages/react/src/store/userStore.js
• packages/react-native/src/store/userStore.js

2. Created Ephemeral Credentials Store

New File: packages/react/src/store/totpCredentialsStore.js

Temporary store that:

• Holds credentials ONLY during TOTP (Two-Factor) authentication flow
• Automatically clears on login success, error, or modal close
• Lives for seconds, not minutes/hours

3. Updated Authentication Hook

File: packages/react/src/hooks/useRCAuth.js

Changes:

• Use useTotpCredentialsStore instead of global useUserStore
• Call setTotpCredentials() when TOTP required
• Call clearTotpCredentials() on success/error

4. Updated TOTP Modal

File: packages/react/src/views/TotpModal/TwoFactorTotpModal.js

Changes:

• Retrieve credentials from ephemeral store
• Clear credentials when modal closes
• No longer reads from global userStore

5. Exported New Store

File: packages/react/src/store/index.js

---

✅ Testing

Manual Testing Completed:

• ✅ Login with username/password (normal flow)
• ✅ Login with TOTP required (2FA flow)
• ✅ Check React DevTools - no password visible
• ✅ Cancel TOTP modal - credentials cleared
• ✅ Error during TOTP - credentials cleared
• ✅ Success after TOTP - credentials cleared

---

🎯 Migration Notes

Breaking Changes: None - This is an internal security fix

Backward Compatibility: Fully backward compatible

• No changes to component props
• No changes to public APIs
• Existing login flows work unchanged
• TOTP flow works unchanged (just more secure)

---

📊 Impact Analysis

Files Changed: 5 modified, 1 created
Risk Level: LOW - Internal state management only
User Impact: POSITIVE - Improved security with no UX changes

---

Security Severity: CRITICAL (CWE-312)
Fix Timeline: Within 24 hours (requirement met)

[CLAassistant]

All committers have signed the CLA.