I'm currently building a facade that's supposed to be in front of a system we are currently using. This system has its own API, but we have decided to simplfy things, and therefore the facade.
However, this system requires the consumer to log in using Forms authentication. Once the consumer has signed in, the system sets two cookies. These cookies are later on used for the authentication and both cookies will eventually expire (after 1800s).
Since I'm building a facade that's supposed to be consumed by others later on, should I somehow store the cookies that the other system generates for re-use when the same user tries to use my facade? Since that seems like a potential safety risk. Or should I simply re-authenticate all requests again as soon as a user uses my facade? This facade will also be load balanced, which complicates things a bit since I would prefer to not store any tokens in a database, but on the other hand, if I don't, the tokens won't be re-used between all the server nodes.
What's the common practice for a scenario like this? Basically this would be our infrastructure and the "flow" of the request:
[User] -AUTH-> [Facade] -AUTH-> [System]