Thanks for your responses-

I have two questions:

-1-What is a SALT, which you propose?

-2-As I cannot obtain password through the iframe settings, maybe I can do something by coding the load method of the iframe. Maybe I can encrypt the password. But what class has the user password. I see that userinfo has userid, email, etc, but not the password. How can I obtain password by coding?

A safe procedure for a secure login to a remote site, we implemented for a customer, worked like this:

• when the user enters the transfer page (with iframe, popup or forward page, logging into a remote site with user credentials),
• the web server sends a request to the target server containing user id, using a secret key and requesting a user "ticket"
• the target server verifies the request and sends back to the web server (by webservice, URL, file) the ticket, which is valid for a limited time
• the web server requests the target page using an url containg the (encrypted) user id and ticket.

At what point do you see password inside the querystring?

IFrame module is not set up (and unlikely ever will be) to pass passwords. So, if you want to do that - you'll have to modify IFrame code or  have tha password passed to IFrame module as a pass-through value (you should definitely NOT use QueryString for that - at least hide it in a form field).