What is the best way to pass sensitive data while using a URL redirect?

Question

I am looking at a web application that redirects a user to a different site based on a user selection. Following is the scenario

1. The user logs in to a web portal (IBM WebSphere portal)
2. Then user makes a selection, the user is redirected to a JSP page on a different web portal (running WebSphere). But right now no other data is passed to the JSP.

I would like to pass some sensitive data (the user id in this case) to the redirected page. I can do the following:

http://newsite.org?UserId=xxx

However I am uneasy about passing the data as a query string. Would using https instead of http help? What are my options?

Answer 1

We have encountered a similar scenario and we encrypted the entire query string in request. We introduced a filter component which will then decrypt it and pass it on to the handler, on a very high level. You can use https or Post, but nothing is safe from intrusion untill you take a good care.