title: MVC Site Authentication application only
body: <p>I need to limit access for my MVC site and accept only requests that come from another site. 
  Inside a main site i have a link that will re-direct in child site users that are already authenticated.
  So i would like to process this request and authorize users if they clicked in this link.
  I'm thinking to share a token in both applications, but when i re-direct user i can't attach this token to the request (true ?)  but only in query string. </p>
  
  <p>My query string have alredy the userId and two integer values.</p>
  
  <p>Here is my code from Main site </p>
  
  <pre><code>public void Redirect(HttpResponse response)
  {
      var userId = HttpUtility.UrlEncode(_encryptor.Encrypt(_userId.ToString(CultureInfo.InvariantCulture)));
      var year = HttpUtility.UrlEncode(_encryptor.Encrypt(_compilationYear.ToString(CultureInfo.InvariantCulture)));
      var month = HttpUtility.UrlEncode(_encryptor.Encrypt(_compilationMonth.ToString(CultureInfo.InvariantCulture)));
      const string baseUrl = "http://localhost:63415/Home/Index"; //external site
  
      response.Redirect(String.Format("{0}?userId={1}&amp;year={2}&amp;month={3}", baseUrl, userId, year, month));
  }
  </code></pre>
  
  <p>and in child site side </p>
  
  <pre><code>public HomeController : Controller
  {
      [HttpGet]
      public ActionResult Index()
      {
              //if request come from the main site 
              var encUserId = Request.QueryString["userId"];
              var encYear = Request.QueryString["year"];
              var encMonth = Request.QueryString["month"];
              //else show unauthorized page error
      }
   }
  </code></pre>
  
  <p>What about set cookie with token ?</p>
  
  <p>I can change code but not in aspx where i have </p>
  
  <pre><code>&lt;foo:MyButton Alt="redirect" 
   Enabled="true" Height="22" Id="btn"
   OnClickJs="Foo()" runat="server"
   /&gt;
  </code></pre>
  
  <p>Now i'm thinking to perform post action via jQuery inside Foo() method... but i have the error </p>
  
  <pre><code> No 'Access-Control-Allow-Origin' header is present on the requested resource.
  </code></pre>