authentication - Auto login user to third party site without showing a password to him -

background

We are unifying third party email solutions in our site. When a user goes to the Mail page, then it must be automatically authenticated on the mail site.

For now, our page has mail link points which automatically submits a form with the user's login and password by clicking Submit After the user is redirected to the mail site with the certification cookie.

The problem with this approach is that we do not want the user to see their mail password, because we automatically generate it for ourselves and some prudent reasons to show it Are not for

Question

Is there a way to get mail authentication cookies without sending the login information to the client and doing the form.submit operation from the client's browser Are you Is there a better way to do this, what am I trying to do?

Edit

Of course "I'm trying to programmatize it". It seems that the client does not have any valid solution except these logins / passwords. It seems that we have to admit that the user can see his mail password and in any way make sure that he can not use this information to change the password of any other value that we do not know.

edit: I did not read the post correctly, I thought it was Was trying to enter a remote mail application, which was not hosted on its own server. Do not ignore this answer.

When you log into the remote third party mail website, they make cookies (since HTTP is stateless, this is the only way a user knows that unless he stores Some type of session ID in the URL). When you send the user to that site, the site needs to authenticate the user. Even if you have logged in with your application and have caught a cookie, then you can set a cookie on the user's browser for other websites. The only way to do this is to work on a third party website that you can develop to some extent, or they allow you to use session IDs in the URL.

Possible solutions but there is a security risk If they allow you to set session_ID in the URL (for example PHP, PHPSIDAD), you can catch session IDs And you can add it to the URL when sending to the user. I really do not like this idea because if the user clicks on a link in the e-mail, then the new page will be able to check in the context and see its session ID in the URL. This can be a major security risk.