We are in the process of creating a web application that requires decrypting data stored on our server using the user's password. Our objective is to avoid repeatedly asking the user for their password, so we are considering storing the password in a global JavaScript variable after login for easy access when downloading and decrypting files. While this approach may offer convenience, I am concerned about the security implications of keeping the password stored in this manner.
Is my concern valid or am I simply being overly cautious? If storing the password in a JavaScript variable poses a security risk, how can we securely implement this feature without compromising convenience?
Edit:
The data is encrypted client-side during upload and will be decrypted client-side upon download. The user's password is stored on the server hashed with SHA-256 for added security measures.