Login password from a POST request is left in browser memory in clear text as long as cache is not cleared (manually/closing browser).
Connection is HTTPS.
- Generate public-key and private-key on server for each login request.
- Send public-key to browser.
- Decrypt using the private-key and validate.
- Delete keys after login.
My question is, is this feasible? Pros and Cons? Are there any security vs. performance considerations?
I've gone over a few questions like: