For customer reasons, my web app authenticates the user against a proprietary user database using a simple API like bool authenticate(string username, string password)
In case the user changes his password or his account is closed etc., I will need to periodically (say every half hour) re-authenticate against the user database, but I obviously don't want to ask the user for his password every half hour.
I'm using ASP.NET core cookie authentication. Is it reasonably secure to store the plain-text password in a claim so that I can get it back when I want to re-authenticate? Of course the claims are signed and encrypted by asp.net and only ever transmitted over a secure channel.
It seems to me that compared to the risk of an attacker intercepting the original login request or interfering with the user's password manager, the additional risk associated with this approach is minimal.
The other approach I considered would be to generate a session Id to use in the claim and then store the mapping of session Id to plain-text password on the server. This would be even worse IMO.