session credentials on the client

Question

I am developing an IE11 based application running on a web server inside our corporate network

The application makes calls to a 3rd party API which requires client certificates and username/password in the url. The url uses SSL. In the application I am using ajax to send url. This all seems to work. I am prompted for a certificate and credentials verification seems to work.

My concern is building a login form and persisting the user credentials if the login succeeds. The only way I can test the credentials is to run a query and see if the result string returned is marked as successful. As far as I can tell, there is no mechanism in the API to return a session token. I think I have to keep the username and password in the client session if I want to make future url calls in the session. I was thinking of using sessionStorage objects but it seems like this could be a bad idea.

I am no security expert and would appreciate any guidance on whether using sessionStorage is a reasonable approach. Is there a more secure way to do this considering the limitations of the 3rd party API?

Answer 1

As Tom has pointed out, the only obvious risk is that the credentials are persisted on the client when you use local storage.

Your description of the application has confused me somewhat. I presume you mean this actually runs on the browser, is served from a local webserver, but calls an ajax service on a remote system. If so, why not just store the credentials on the session with the local server?

Alternatively, instead of local storage, using a session cookie (associated with your local server) to store the credentials would mean that the data would be harder to read after the user closed the browser, but would still persist on the storage for some time.

If this is not a single page application (where you could simply keep the data in a javascript variable, then the only options I can think of for ephemeral storage which would survive page transitions are

• the window.name
• running the application in a frame while retaining the data in javascript in a non-updating frame in the same window

Note that these do not necessarily need to contain the plain text of the credentials but might store a randomly generated key used to encrypt/decrypt the redentials stored somewhere less secure.

Answer 2

At the end of the day, if the computer is owned by a single user AND is inside a secure network, it shouldn't be too terrible storing it as plain text. Of course, problems might arise if the user leaves his computer unattended - But since the API you're using doesn't return session keys (which is really odd...) there's no real better solution.

Additional security you could implement is protection from XSS so the credentials don't get stolen by malware, and making sure the session storage is properly deleted after a set amount of time.