Abstract: A method for enforcing access control to a web application. The method includes generating a computationally-secure pseudo-random password, associating the generated computationally-secure pseudo-random password with an application username of at least one web client, and storing, in a user account credential store module, the generated computationally-secure pseudo-random password and the associated application username. The method also includes requesting, via a web proxy connected to the at least one web client, access to a protected page offered by the web application, intercepting, by the web proxy, a login page from the web application, and inserting, by the web proxy on behalf of the at least one web client, the stored generated computationally-secure pseudo-random password and the associated application username into the login page.