I have a C# web application on .net 2.0 being hosted on server A. The web application allows users to upload files using <input id='File1' name='filMyFile' type='file' runat='server' /> to server A. This all works just fine.
I am now being asked to modify the web application to allow pages being served by A to allow uploading directly to server B without storing any information on A not even temporarily.
I am being asked to do this for security reasons. I was thinking about possibly using an iframe and having server B only host the upload portion wrapping the request with SSL. I am not entirely sure of the security implications of doing this, however I have seen a few websites in which for their login controls they SSL only an iframe which contains the login portion and the rest of their site was unsecure.
Is this an OK thing to do? Can someone recommend a better way? Perhaps suggest a basic architecture.
I have used the iframe approach, where the iframe code with the upload form is hosted on Server B. It worked reasonably well. You could also host the entire page on Server B if you want.