Protection of application passwords using a secure proxy

A computer-implemented method comprising:

• receiving, by a proxy server from a client computer, a request to access a protected resource located on a target server;
• sending, by the proxy server to the client computer, an authentication challenge;
• receiving, by the proxy server from the client computer, a response to the authentication challenge;
• in response to authenticating, by the proxy server, the received response to the authentication challenge, initiating a secure active session between proxy server and client computer;
• forwarding, by the proxy server to the target server, the protected resource access request;
• receiving, by the proxy server from the target server, an access request response, wherein the access request response is a credential form including credential fields required to access the protected resource;
• injecting, by the proxy server, into each required credential field, a corresponding credential field tag;
• sending, by the proxy server to the client computer, the tagged credential form;
• receiving, by the proxy server from the client computer, the tagged credential form with tagged credentials in the required credential fields with the credential field tags;
• retrieving, by the proxy server from a protected datastore, target credentials mapped by the credential field tags;
• replacing, by the proxy server, the tagged credentials in the tagged credential form with the corresponding retrieved target credentials;
• sending, by the proxy server to the target server, the target credentials;
• receiving, by the proxy server from the target server, an indication that the target credentials are invalid;
• updating, by the proxy server, the target credentials and storing the updated target credentials in the protected data store without client computer intervention;
• sending, by the proxy server to the target server, the updated target credentials;
• and
• allowing, by the proxy server, the client computer to access the protected resource, in response to the target server validating the updated target credentials.