Web service user authentication - storing password on client

Question

I'm working on a soap webservice that needs some basic authentication.

So the idea is to just require that all webservice methods contain a username and password parameter, and then verify that those values exist in our users database:

public String[][] someWebserviceMethod(String username, String password) throws FailedLoginException {

    // Verify that user with username and password exists

    //do database stuff and return data
}

This does raise a problem on the client side. After the user initially logs in to the application, we'll need to store the username and password in memory as plain text. Is that acceptable? If not what is the preferred method?

Also, my webservice will be hosted on https. Does this ensure that the password is securely encrypted when the client sends a soap request?

Edit: Would a sessionID work? I've never implemented one without a framework or web server doing it for me. Maybe something like this:

1. Client sends username and password.
2. If client is valid, server returns random string (sessionId).
3. Server stores sessionID and timestamp in database
4. Client stores the sessionID in memory, does not store password
5. Client requests web method with username and sessionID
6. If user with username and sessionID exists, and timestamp within timeout period, grant access and update timestamp. Else force re-login.

Answer 1

Yes HTTPS - S stands for secure and it encrypts all communication. But u can always use some other encryption methods like MD5, SHA-1 and more common ones. If you are doing this for some basic training it's ok to store the data in plain text /json without any encryption, otherwise check out these hash functions:

• https://en.wikipedia.org/wiki/SHA-1
• https://en.wikipedia.org/wiki/MD5