Data transfer from one website to another

I have two websites A and B both written in ASP.NET MVC 3. In website A there is a form which needs to be submitted to website B via POST method. The user has option to post it directly or after encrypting the values.

When I submit form without encryption it is simple form.submit() and I am able to get the values in website B using FormCollection object. But when user selects submit after encryption, I redirect to another action on website A itself where encryption occurs and then this encrypte开发者_开发知识库d data is placed in a hidden textbox in the corresponding view and then auto submitted on page load using jQuery to website B. But now I am unable to get any values in FormCollection object on website B.

What could the problem be? Is this happening because of any security feature to prevent XSS or something similar?

---

Its doubtful its from XSS protections - in that case you would see an exception. Load up fiddler and make sure you see this data in an element inside your form that is getting posted to website b. if its there in the form that is being submitted - it should be available.

---

Any reason for not using HTTPS and submitting directly the form to site B?

<form action="https://siteb/someaction" method="POST">
    <input type="text" name="key1" value="value1" />
    <input type="text" name="key2" value="value2" />
    <input type="text" name="key3" value="value3" />
    <input type="submit" value="Go ahead" />
</form>

If there is any reason in the case you are encrypting the values into a single hidden input and submitting the form containing this hidden field using javascript, only the value of the hidden field will be sent to site B. So for example if you had the following form:

<form action="http://siteb/someaction" method="POST">
    <input type="hidden" name="encrypted" value="some encrypted value" />
</form>

on site B you would fetch the encrypted value like this (don't use FormCollection, it's kinda ugly compared to view models):

[HttpPost]
public ActionResult SomeAction(string encrypted)
{
    // TODO: decrypt the encrypted value here to get the orginal string
    ...
}

And an even more elegant way would be to have a view model defined on site B and a custom model binder for this model that will do the decryption so that the action looks simply like this:

[HttpPost]
public ActionResult SomeAction(SomeViewModel model)
{
    // Directly use the model with all the fields in it.
    // The custom model binder will take care of the creating it
    // from the encrypted request string
    ...
}