I have an old bit of code that does a redirect on a Visualforce page to a secure web-based app. It constructs a PageReference and puts key and secret required by the external app and other somewhat sensitive information right in the url parameters.
I have tried PageReference.getHeaders() and adding what i need there. That didn't seem to work, even though it doesn't error. I later read that Salesforce strips those away for some reason?
So any tips on how to url redirect to an external site without the secret (even an encrypted secret) in the url would be appreciated.