Sending a password as part of an HTTP redirect will cause the password to be displayed, logged, or stored in a cache.
An HTTP redirect causes the user's web browser to issue an HTTP GET request. By convention, the parameters associated with an HTTP GET are not treated as sensitive data, so web servers log them, proxies cache them, and web browsers do not make an effort to conceal them. Sending a password or other sensitive data as part of a redirect will likely cause the data to be mishandled and potentially revealed to an attacker.
Example 1:
response.sendRedirect("j_security_check?j_username="+usr+"&j_password="+pass);
[1] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A7 Insecure Cryptographic Storage
[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A8 Insecure Cryptographic Storage
[3] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A8 Insecure Storage
[4] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3330 CAT I
[5] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 359
[6] Standards Mapping - FIPS200 - (FISMA) IA
[7] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) Information Leakage
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 3.4, Requirement 6.3.1.3, Requirement 6.5.8, Requirement 8.4
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 3.4, Requirement 6.5.3, Requirement 8.4
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 3.4, Requirement 6.5.8, Requirement 8.4