We have created a portal to login to the sites for the customer. We are managing the credential(username and password) on the third party website. When I open this link anywhere it shows that the person is logged in. I also used the Burp suite(application) to access the portal, I was able to hack all Data as it is not authorized or managing the Session.
How to maintain the security of the customer. I'm not sure how to resolve this? How can we maintain the session?