c# - 带有 SecureString 的 JSON ToObject

Question

我在将 JSON 文本序列化为包含 SecureString 变量的对象时遇到问题。我如何序列化以下内容，同时将公共(public)“pwd”变量保留为 SecureString？

假设有以下字符串:

string j_str = "{ 'uid':'JohnDoe', 'age':30, 'pwd':'MyPassword' }";

我想将此字符串序列化为 C# 中的对象

public class User
{
   public string uid = { get; set; }
   public string age = { get; set; }
   public SecureString pwd = { get; set; }
}

因此，我可以使用 JSON ToObject) 与 Newtonsoft 进行以下调用，如下所示:

JObject j_obj = JObject.Parse(j_str);

User newUser = j_obj.ToObject<User>();

这会导致以下错误:

Newtonsoft.Json.JsonSerializationException: 'Error converting value "MyPassword" to type 'System.Security.SecureString'. Path 'pwd'

Answer 1

从字符串构造它似乎违反了使用 SecureString 背后的原则。请参阅https://msdn.microsoft.com/en-us/library/system.security.securestring(v=vs.110).aspx :

A SecureString object should never be constructed from a String, because the sensitive data is already subject to the memory persistence consequences of the immutable String class. The best way to construct a SecureString object is from a character-at-a-time unmanaged source, such as the Console.ReadKey method.