I'm building special extension ( on domain B ) to the present e-commerce hosted on a domain A. The goal is to redirect user from A to B and back. Similar to technique where user leaves e-commerce site to the credit card payment web interface and then redirected back. Both domains are secured with SSL/TLS. User registers only on site A. Site B needs to know only users mobile number.
I came with one solution: Page A encodes users data and common secret into hash. Data and hash are posted to B. Page B receives data and hash. Then it makes its own hash out of data and common secret and compares it with hash from post request.
Flaws with this idea. Any better idea. Cookies ?
Edit: I'm trying to prevent that someone could address domain B from elsewhere. Site B provides some reservation process (mobile number as reference, sending check-in codes via sms). Someone bad could do the reservation and make our system run out of empty slots or spam us and other users - bad for buisness .