This is sort of how JA-SIG CAS (enterprise SSO) works. To apply that architecture to your instance, setup the following on WebsiteB:

1. Have WebsiteB generate a unique token in the link such as in the query string.

   <a href="https://websiteA/?MyTokenForWebsiteB=unique_token_value>Specific Link</a>

2. Setup a web service on WebsiteB, which is only accessible from WebsiteA, to validate the authenticity of tokens.

When users click on the link in WebsiteB and arrive at WebsiteA, perform the following on WebsiteA.

1. Check that unique token exists and there's a value.
2. Validate token against web service on WebsiteB

This is sort of how JA-SIG CAS (enterprise SSO) works. To apply that architecture to your instance, setup the following on WebsiteB:

1. Have WebsiteB generate a unique token in the link such as in the query string and make sure it uses SSL. Store the token information in a database (or similar method). Be sure to include a timestamp for when it was issued so time restrictions can be enforced.

   <a href="https://websiteA/?MyTokenForWebsiteB=unique_token_value>Specific Link</a>

2. Setup a web service on WebsiteB, which is only accessible from WebsiteA via SSL, to validate the authenticity of tokens issued. Include logic to not allow tokens older then some predetermined limit (5 minutes?).

When users click on the link in WebsiteB and arrive at WebsiteA, perform the following on WebsiteA.

1. Check that unique token exists and there's a value.
2. Validate token against web service on WebsiteB