Vulnerable Transmission of Credentials

Even on a secure HTTPS connection, unauthorized parties may exist:
Within the user’s browser history, within the web server logs, and within the logs of any reverse proxies employed within the hosting infrastructure.
When the login request being handled via a redirect to a different URL with the same credentials passed as query string parameters.
When Web applications store user credentials in cookies, usually to implement poorly designed mechanisms for login, password change, “remember me,” and so on.