title: <h:inputSecret /> Security: is there a way to use a straight reference to char[] instead of a String?
body: <p>Preamble: This might be a giant noob mistake, all the developers on my team are a little fuzzy at the Java 101 here so if we're worrying about nothing please let me know. <em>[worried about String literals cached in permgen to be specific]</em></p>
  
  <p>We have a simple login page that basically looks like:
  //Backing Bean "LoginBean"</p>
  
  <pre><code>  String username;
    String password;
    //getter/setter pairs
  </code></pre>
  
  <p>//JSF</p>
  
  <pre><code>  &lt;h:form id="login"&gt;
      &lt;h:inputText value="#{loginBean.username} /&gt;
      &lt;h:inputSecret value="#{loginBean.password} /&gt;
      &lt;h:commandButton actionListener="#{loginBean.login} /&gt;
    &lt;/h:form&gt;
  </code></pre>
  
  <p>My concern here is that a string literal being passed could be cached and opens potential security holes. Is there a ways to set this up so that we bypass a string literal entirely? If this were a Swing application I'd be using JPasswordField which explicitly has "char[] getPassword();"</p>
  
  <p>or in code I want:</p>
  
  <pre><code>String username;
  char[] password;
  </code></pre>
  
  <p><em>Thanks for the help, if it is a double post feel free to slap me, I can't seem to find it but it seems like a core issue.</em></p>