title: Can I securely store username and password in PHP session variables?
body: <p>I want to make a light webapp on top of a REST api, where the user should authenticate only once, from then on all request against the web api would hopefully be done by keeping alive the username and password in some way.</p>
  
  <p>I have already made a <strong>working prototype</strong> where I <strong>store the username and password in session variables</strong> if the first request to the REST api is successfull, and from then on every request is made with auth info gotten from the session variables. So far so good.</p>
  
  <p>With this approach, I realize someone with access to the server would be able to read the password. Is there some way in PHP that i could follow my approach with an appropriate amount of security?</p>
  
  <p><strong>Update with some further details:</strong></p>
  
  <p>The intended goal here is to make a visualisation of data retrieved from an API, based on querying it with different data, but not having the user enter his username and password for each attempt. So the API is totally stateless, but the web application with gui should be statefull.</p>
  
  <p>In this case I have no control over the Rest API, so each request to it will always require sending the API username and password with basic auth, there are no alternative schemes such as a API key, session token or anything like that. This is why I have to retain the username and password for as long as a user session lasts, and I wanted to know if the approach with storing them in session variables could be considered secure.</p>