title: What is a good way of forwarding credentials within a web environment?
body: <p>Given the following configuration:</p>
  
  <ul>
  <li>a web client = a regular, modern browser;</li>
  <li>a typical <em>ASP.NET</em> web application, somewhere on the Internet;</li>
  <li>a third-party web service that:
  
  <ul>
  <li>sits in another domain (no relation via <em>federation</em>, <em>domain trust relations</em> or so);</li>
  <li>cannot be touched / configured;</li>
  <li>is accessible via the Internet;</li>
  <li>is connection-less;</li>
  <li>requires each web request to be authenticated;</li>
  <li>supports a common authentication scheme (Windows) and provides a <em>SDK</em> that allows setting the credentials (username, password) when preparing a request.</li>
  <li>does not support <em>OAuth</em> or similar techniques, so there's no identity token that can be used instead of credentials.</li>
  </ul></li>
  </ul>
  
  <p>The <em>ASP.NET web application</em> would implement most of its features by making requests to the <em>third-party web service</em>. Thus the web application requires the <em>Windows credentials</em> of its users.</p>
  
  <p>The <em>ASP.NET web application</em> would act like a <strong>UI proxy</strong> for the 3rd-party web service. Furthermore, the 3rd-party web service is not a singleton. The web application is supposed to be a <em>UI proxy</em> for many instances of those 3rd-party web services (so many Windows domains). Therefore, the web application would act like a <strong>de-multiplexing UI proxy</strong> - if there is such a term :) It proxies several instances of the 3rd party web service.</p>
  
  <p>Now I am beating my brains out to find a secure way of passing user's credentials (username, password) from the web client to the third-party service, via the web application :)</p>
  
  <p>Where can the credentials be <strong>kept</strong> securely after the user provides them, at the beginning of a work session, until the work session ends? I though of various media such as: <em>HTTP cookies, HTTP headers, HTML local storage, server memory, web session, application database</em>.</p>
  
  <p>With respect to the question above, what is a good way of encrypting the credentials so that they can be decrypted when required, that is, when preparing the request for the third-party web service (symmetric encryption)? All communication is <em>HTTPS</em>.</p>
  
  <p>I know this is a weird puzzle :)</p>
  
  <p><strong>Update</strong></p>
  
  <p>Perhaps getting the 3rd-party web service to support a brokered authentication pattern (then use <em>OAuth</em> or something similar) would be best. Right?</p>
  
  <p><strong>Update: similar (or duplicate?) questions - seems to be a popular issue</strong></p>
  
  <p><a href="https://stackoverflow.com/questions/1994112/i-must-store-third-party-credentials-in-my-database-best-way">i *must* store third party credentials in my database. best way?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/14048219/how-to-store-user-password-for-third-party-service-in-python">How to store user password for third party service in Python?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/18595611/security-model-log-in-to-third-party-site-with-users-credentials">Security model: log in to third-party site with user&#39;s credentials</a></p>
  
  <p><a href="https://stackoverflow.com/questions/15084025/storing-third-party-passwords-for-reuse-across-pages">Storing third-party passwords for reuse across pages</a></p>
  
  <p><a href="https://stackoverflow.com/questions/8036233/what-is-the-best-way-to-store-password-in-database-when-api-call-requires-sendin">What is the best way to store password in database when API call requires sending of password in plain text?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/1819023/encrypting-3rd-party-credentials">Encrypting 3rd party credentials</a></p>
  
  <p><a href="https://stackoverflow.com/questions/12628921/whats-a-smart-way-of-storing-user-credentials-for-an-external-site-that-does-n">What&#39;s a smart way of storing user credentials for an external site (that does not use OAuth)?</a></p>
  
  <p><a href="https://security.stackexchange.com/questions/31535/need-to-ephemerally-store-third-party-password">Need to ephemerally store third-party password</a></p>
  
  <p><a href="https://security.stackexchange.com/questions/1335/storing-third-party-auth-info-securely">Storing third-party auth info securely</a></p>
  
  <p><a href="https://security.stackexchange.com/questions/22760/reversible-password-storage-obfuscation-method-for-third-party-login-credentials">Reversible password storage obfuscation method for third-party login credentials</a></p>
  
  <p><a href="https://security.stackexchange.com/questions/7580/storing-the-third-party-credentials-in-the-database-some-secure-place">storing the third party credentials in the database/some secure place</a></p>