Question: I have a user on website A and I need to log him to website B (not under my control) but without jeopardizing his password on website B. Website B doesn't have an API which is what's making this more complicated than should be. 

My first option is to render my own form on website A, user enters his website B password into my form, and I somehow securely pass his website B password to website B to log him in. This means I have to first pass the password securely from the client to my server, then pass it again securely from my server to the end website. That's what I'm guessing I have to do, but I don't have a plan for how to implement these 2 hops securely, so I worry that I might expose the user's password somehow.

So I thought of the second option which is to render the same website B from website B onto my website. But the form on website B is part of a larger page, so can this be done?

* How would I isolate the code for the form itself from the code for the full page
* how to present the form on my website. I want the user to see it. iframe comes to mind but never worked with it
* will the form still be valid when the user clicks the submit button or does rendering the form on my website somehow invalidates it

These are the 2 different solutions I thought of. I welcome answers for each of them, and also welcome answers that suggest an alternate third approach that may be easier.

Answer: 
It all depends on how the server you are POSTing to handles CSRF [Cross-Site Request Forgeries], as that is basically what you are doing. If they are using a Django that is relatively recent, for instance, then POST requests from an outside server will by default fail, unless they contain the csrf cookie value.

It is possible to get around this, if you have control of the server you are POSTing to as well.
To isolate the form from the larger page, find the `<form>` and `</form>` tags, and only copy any and elements between them. Now put that form on your page, with its action still pointing to the URL it was pointing to on the original website. The password never goes through your server.