Pass username and password from JSF or JSP to Oracle reports

I would like to know if there is a way to use JSF, JSTL or JSP to pass the user ID and password to other applications without being visible when the user sees a hard-coded value in the browser's view source?

Ideally I would like to name the Oracle report in a JSF or JSP page, so how can I pass the username and password without adding hidden fields or input fields so that when the user looks at the view source in the browser, he should not be able to view authentication data.

I can add something like

Map map = new HashMap();
map.put("username", "SMITH");
map.put("password", "SMT");
FacesContext.getCurrentInstance().getExternalContext().getSessionMap()
        .put("reportParams", map);
ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
ec.redirect("http://server:8889/reports/rwservlet");

      

        
        
        
      

    

but not sure how to pass the map using url or how to call this using JSTL or in a JSF page. Even if I pass as a parameter, the user will be able to see the parameter values, perhaps.

Any help is greatly appreciated.

thank