title: How can be sure if a user is coming from a specified website in only one HTTP GET request?
body: <p>I have 10 websites hosting in my IIS. A user clicks on a link in <code>site 1</code>, the <strong>secret value</strong> generated in server-side (of <code>site 1</code>), then I want to send this <strong>secret value</strong> (encrypt or hash) in URL (query string) to <code>central site</code> and decrypt/validate the value there, to be sure a user is coming from <code>site 1</code> to proceed (and not from another websites).</p>
  <p>I think it won't be something fixed string so users can make this URL themselves:
  <code>https://centralSite.com/process?param1=....&amp;param2=....&amp;source_website=site1</code></p>
  <p>It should be something like a <strong>one-time dynamic generated</strong> token.</p>
  <p>My question is :</p>
  <ol>
  <li>Can I achieve this situation in only <strong>ONE</strong> <code>HTTP GET</code> request?</li>
  <li>Should I use encryption/decryption or hashing/validating (all server-side)?</li>
  </ol>
  <p>P.S: I can't use POST or other HTTP verbs here.</p>
  <p>P.S: I know about <code>HTTP referrer</code>, but it can be spoofed or be null in some situations.</p>
  <p>P.S: All websites are serving on HTTPS protocol.</p>