We develop a Windows client application that locally caches a user's credentials for connecting to our server application using the Windows Credential Management API.
Our caching logic works in the following way:
- The user opens the application and selects a server in the UI. It then queries the server for authentication requirements. (If no credentials are needed, then we just connect without authentication.)
- The application reads the cache to see if there are cached credentials.
- If there are existing cached credentials, they are used. Otherwise, the Windows API is used to bring up a dialog box.
- The application attempts to authenticate with the server using the credentials.
- If the connection is a success, then the credentials used are cached for the lifetime of the Windows session (this is a feature of the Windows API). Otherwise, we clear the cache and return to step 3.
The question is: are there other valid situations where the credential cache should be cleared? In other words, what would you consider to be best practices on how to manage the lifetime and invalidation logic for this potentially sensitive information?
(Since I will probably be asked, the information we store using this API is encrypted using our own encryption logic, and stored in memory via SecureString. No doubt there are potential holes in this approach, but that is for another discussion.)