Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
2 add example of when you might want to do this
source | link

I believe the reason it is considered insecure to send the passwords back to the client is because the client may cache the page, meaning there is a version of the password in plain text stored somewhere on the user's local drive. Hitting the back button or parsing the cache could reveal the password. This is especially bad on public machines.

Also, there are valid scenarios where you might want to do what the OP is suggesting. For example, if you have a registration screen with a captcha on it, having the user retype two passwords every time they fail the captcha might be overly annoying. But if your site is important enough to require a security audit, then you're probably better off avoiding this, and instead consider making your captcha easier.

I believe the reason it is considered insecure to send the passwords back to the client is because the client may cache the page, meaning there is a version of the password in plain text stored somewhere on the user's local drive. Hitting the back button or parsing the cache could reveal the password. This is especially bad on public machines.

I believe the reason it is considered insecure to send the passwords back to the client is because the client may cache the page, meaning there is a version of the password in plain text stored somewhere on the user's local drive. Hitting the back button or parsing the cache could reveal the password. This is especially bad on public machines.

Also, there are valid scenarios where you might want to do what the OP is suggesting. For example, if you have a registration screen with a captcha on it, having the user retype two passwords every time they fail the captcha might be overly annoying. But if your site is important enough to require a security audit, then you're probably better off avoiding this, and instead consider making your captcha easier.

1
source | link

I believe the reason it is considered insecure to send the passwords back to the client is because the client may cache the page, meaning there is a version of the password in plain text stored somewhere on the user's local drive. Hitting the back button or parsing the cache could reveal the password. This is especially bad on public machines.