3

I am not sure if there is a good way to do this. Currently I have a website that users log into. In that website there is pages that have API calls to another service, this service uses:

Authorization: BASIC username:password

Where the username and password are not the same as the ones used to log into site. Is there a way I could have it where they do a second login in my site (once they go to one of these pages) and then use this base64 auth string across multiple pages on my site securely?

I can't exactly store the username and password in a database, since it would just be plaintext. Currently I could have them submit the user/pass on every page that needs the API and just post it without storing it, but this is a MAJOR pain to do on every single request.

Is there a possibly way to store this for the duration of their login on my site securely?

  • What kind of stack are you using? – Aria Feb 5 '18 at 15:40
  • Php, Mysql, Apache. Is the current set up on a linux server. – Lain Feb 5 '18 at 15:51
  • 1
    Where is the oauth component? – David Feb 5 '18 at 16:10
  • @David Not 100% sure what you mean by that. I need to post the oauth info to an API. As mentioned, current design if not figured out is to just have the username/password fields on every page and they need to submit(which would POST the username/password after base64 encoding it for the one request). oAuth is done on the API side, I just hand it the string. – Lain Feb 5 '18 at 16:18
1

Maybe you can try the sessionStorage API of the browser to store base64 auth string. Like in some banking websites, you can prompt the user to enter the auth string once they logged in, encrypt the string using the public key of your server and store it in sessionStorage. With each API call you can pass along this encrypted string and decrypt it at your server to perform whatever logic you want.

Once the user is logged out and the browser closed, the value stored in sessionStorage will be removed. Till then the value will be present in your browser storage.

| improve this answer | |
0

Maybe you could store it in the client. That's a little bit crazy idea, but this way you don't have this data on the server.

You can encrypt username/password with symmetric encryption and store it as cookie.

This way, every time user requests a page, he sends encrypted cookie, which you decrypt and send request to your service with.

That's not a bullet proof solution but this way you don't have all credentials on the server and you don't have it plaintext on clients.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.