I've recently asked a question about blanking the password fields in UX for usability purposes, but It seems all the sites use this approach for security reasons. Why is it insecure to post back the same pass that user has entered?
Good question. Having the benefit of looking at some of the answers, and pondering over this myself, I actually don't see any major security benefits from clearing the password from the partial form returned to the user, but there definitely are some risks worth considering.
From a security architecture point of view (as @Roryalsop already touched on), you usually want passwords flowing only in one direction. From the user to the application, never back. This applies on all layers, and this one-way-system gives benefits from a security point of view. Having an exception to this rule might or might not be a good idea. But that's why your question is interesting. Does this scenario deserve an exception?
Lets look at some attack vectors and see if nulling the password protects against any of those:
But then, nulling the password is easy enough, shouldn't damage user-experience too much and keep things cleaner from a security standpoint. I would still suggest you keep doing so.
If you're worried about user-experience, try to follow the advice you were already given on UX - perform extra validation on the client side, just so the user gets early feedback. Don't replace the validation on the server. This is the most important validation ultimately. But for user-feedback, client-side validation can work wonders to improve user experience and you don't have to take even a slight risk of the password being cached (or change your security architecture by making an exception).
Because if you then view source on the posted back page, the password will be visible in plain text.
2 key points here:
Both of these have risks.
This is why most websites have password reminder and reset mechanisms, so they don't need to send the password back to you. They may send a one-time password to you as a reset, that you must then change.
Some will send your password in an out of band route, but these are getting rarer as the risks continue to build.
(of course the security of password reset mechanisms is another matter)