Safely forward userID and password

Question

I am writing a servlet/JSP application where a user will see a logon screen once. After successfully entering userID and password, I will display a list of available web applications. User selects one, and I want to forward them on to that application's entry servlet with the userID and password. My question is how to do that 'safely'.
1) Easy to do with a GET-type URL (where url = url?userid=value1&password=value2)using response.sendRedirect(url). However, I found after successful processing by the next application's entry servlet, the userid and password are still displayed in the address bar on the next screen. Is there any way within the receiving servlet to trim those off the displayed url?
2) I tried using the POST, where I contact the next application, get the page back and display it. The problem is the next application adds session data in the entry servlet, and when I just get the page back and display it, the session data is lost. Here's an example of the code I used:
String userInfo = �url?userid=value1&password=value2�;
byte[] bytesUserInfo = userInfo.getBytes();
HttpURLConnection urlConn = (HttpURLConnection)
url.openConnection();
urlConn.setDoInput(true);
urlConn.setDoOutput(true);
urlConn.setAllowUserInteraction(true);
urlConn.setUseCaches(false);
urlConn.setFollowRedirects(true);
urlConn.setRequestProperty("Content-length",
String.valueOf(bytesUserInfo.length));
OutputStream out = urlConn.getOutputStream();
urlConn.connect();
out.write(bytesUserInfo);
out.flush();
out.close();
String responsePage = "";
String line = "";
BufferedReader in = new BufferedReader(
new InputStreamReader(urlConn.getInputStream()));
while((line = in.readLine()) != null) {
responsePage += line + "\n";
response.setContentType("text/html");
PrintWriter pw = response.getWriter();
pw.println(responsePage);
pw.flush();
pw.close();
So I would display the responsePage (the second screen of the next appliction, typically a menu). But the next application expects there to be session data attached, which it established in the entry servlet. The way I get the page and display it, the session info is lost.
3) I also tried going to a 'invisible' page, then using META tag redirect, or JavaScript redirect, but then the userid and password got lost.
Is there a good way to transparently forward a user and the id and password?

Answer 1

Unfortunately cookies won't work here. The hidden
sessionID might - that's a good suggestion. My
question there is currently appB doensn't use
sessionID's. It just uses
HttpSession theSession = request.getSession(false);This only tells you to not create one if it doesnt exist. But if it exists, and as you are using one, it will use it. On the server there will be a sesssion which can be found by its sessionID, so you are using a sessionID. If a browser doesnt support cookies, a sessionID will be appended to the url, thats your sessionID to find your session in the session object. See request.getRequestedSessionID()
>
I might be missing something easy here, but if it
knows the sessionID is hidden, how can it convert that
to a HttpSession? Will it need some new collection
now to relate the sessionID's to the sessions? I was
looking the the API for an easy way to relate the
sessionID to the actual session, but nothing jumped
out at me.