PasswordValidationCallback.clearPassword() does not clear the password. ----------------------------------------------------------------------- Key: JBEE-194 URL: https://issues.jboss.org/browse/JBEE-194 Project: JBoss JavaEE Spec APIs Issue Type: Bug Components: jboss-jaspi-api Reporter: Darran Lofthouse Assignee: Darran Lofthouse The purpose of clear() methods on classes like this is to zero out the array holding the password, the current implementation just sets the reference to null leaving it to the garbage collector to dispose of - this would happen anyway as soon as the PasswordValidationCallback is eligible for garbage collection,