Client-side encryption using public-key

Question

My situation:

1. Login password from a POST request is left in browser memory in clear text as long as cache is not cleared (manually/closing browser).

2. Connection is HTTPS.

Possible Solution:

1. Generate public-key and private-key on server for each login request.
2. Send public-key to browser.
3. Use JavaScript to encrypt the password with the public-key and send to server.
4. Decrypt using the private-key and validate.
5. Delete keys after login.

My question is, is this feasible? Pros and Cons? Are there any security vs. performance considerations?

I've gone over a few questions like:

1. Hashing client side
2. Webcrypto
3. javascript crypto

The first one doesn't really answer my question as I'm suggesting generating a new pair of keys on every request (which honestly is my biggest worry as far as feasibility and performance). The other two links seem to suggest that javascript crypto is basically pointless as long as you have an HTTPS connection. Thoughts?

Answer 1

Generating another public-private key would be overkill for this senario.

If you're really worried about some malware reading the browser cache, you can instruct the browser to just not cache anything.

<meta http-equiv=”Cache-Control” content=”no-cache” /> <meta http-equiv=”Cache-Control” content=”no-store” /> 

If you're worried about someone reading through the memory to find the plaintext of the username and/or password then you can implement at a solution similar to the one defined in senario #2 here (http://resources.infosecinstitute.com/browser-based-vulnerabilities-in-web-applications/)

Note that you have to scroll down a bit on that page to see the content, there's a giant ad that pops up first.