title: Cookieless sessions and cross-site form posts
body: <p>Here's the situation...  </p>
  
  <p>Site 1) ASP.NET MVC application for customers to login, view and pay bills, etc.  This site is using cookieless ASP sessions to allow multiple sessions to run in tabbed browsers.  </p>
  
  <p>Site 2) Corporate web site with standard static content.  This will have a small form at the top of each page with a username/password form that will post to the MVC application.</p>
  
  <p>When posting to the MVC app, a new session is being generated and the site is returning a 302 redirect with the session ID in the URL (as expected).  The controller has two Login methods, one for handling a GET, one for handling a POST.  Because of the redirect, it's hitting the GET method and it loses the form values.</p>
  
  <p>By changing the method on the corporate site to do a form GET rather than a POST, the username and password are preserved in the query string after the redirect and I could handle the requests that way, but I would rather do a POST and not pass that data around in the URL.</p>
  
  <p>My gut says that implementing some sort of custom HttpHandler would allow me to do this, but I'm not sure where I'd be able to tie into the session creation.  A breakpoint at Session_Start in global.asax shows that the session ID has already been crated and the redirect already happened at that point.</p>