I am developing an IE11 based application running on a web server inside our corporate network
The application makes calls to a 3rd party API which requires client certificates and username/password in the url. The url uses SSL. In the application I am using ajax to send url. This all seems to work. I am prompted for a certificate and credentials verification seems to work.
My concern is building a login form and persisting the user credentials if the login succeeds. The only way I can test the credentials is to run a query and see if the result string returned is marked as successful. As far as I can tell, there is no mechanism in the API to return a session token. I think I have to keep the username and password in the client session if I want to make future url calls in the session. I was thinking of using sessionStorage objects but it seems like this could be a bad idea.
I am no security expert and would appreciate any guidance on whether using sessionStorage is a reasonable approach. Is there a more secure way to do this considering the limitations of the 3rd party API?