<p>In some use cases, 307 redirects might be abused by an attacker to learn the victim's credentials.</p>
<p>Further information can be found in <strong>section 3.1</strong> of <a href="https://arxiv.org/pdf/1601.01229v2.pdf" rel="nofollow noreferrer">A Comprehensive Formal Security Analysis of OAuth 2.0</a>.</p>
<p>The authors of the above paper suggest the following:</p>
<blockquote>
<p><strong>Fix.</strong> Contrary to the current wording in the OAuth standard, the exact method of the redirect is not an implementation detail but essential for the security of OAuth. In the HTTP standard (<a href="https://www.rfc-editor.org/rfc/rfc7231" rel="nofollow noreferrer">RFC 7231</a>), only the 303 redirect is defined unambigiously to drop the body of an HTTP POST request. All other HTTP redirection status codes, including the most commonly used 302, leave the browser the option to preserve the POST request and the form data. In practice, browsers typically rewrite to a GET request, thereby dropping the form data, except for 307 redirects. Therefore, the OAuth standard should require 303 redirects for the steps mentioned above in order to fix this problem.</p>
</blockquote>
What's the difference between a 302 and a 307 redirect?
<p>What's the difference between a <code>302 FOUND</code> and a <code>307 TEMPORARY REDIRECT</code> HTTP response?</p>

<p><a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.3" rel="noreferrer">The W3 spec</a> seems to indicate that they're both used for temporary redirects, and neither can be cached unless the response specifically allows it.</p>