I have noticed that my employer's website, which handles sensitive information, redirects some pages from HTTPS to HTTP on another domain. This feels like a poor practice. Are there any security threats associated with such redirects? Could you please point me to documentation that talks about it? Or is it just a privacy issue? Thanks!
A redirect to HTTP by itself is not a problem, especially since the Referer (which might contain sensitive information) is not included when redirecting from HTTPS to HTTP.
Of course, there might be problems if sensitive information are included in the URL of the redirect target, but this is not actually a problem of the redirect itself (which is still done with HTTPS) but of the following request which accesses sensitive URL's via plain HTTP. But it is not known if this actually happens in your specific case so it is impossible to say if there is an actual problem or not.