How to store user/pass securely in the browser?
cperciva: First, I think the idea of you making API requests using your users' credentials is a bad one from the start.  If the third party in question wants to allow requests-on-behalf-of, they should provide a proper API for it; if not, you shouldn't be working against their wishes by impersonating your users.That said, if you really really have to do this: Have your users provide you with their username and password; generate a random symmetric encryption key; store (username, encrypted password) on your systems and send (username, encryption key) to the user as a cookie.This will give you safety against an attacker who can steal your database or the user's cookies; it won't give you any protection against an attacker who can steal both of those (that would impossible), nor will it give you any protection against an attacker who controls your server at a time when a user tries to use your service (again, that would be impossible).But I still think this is a really bad idea.