Question

I have two websites https://www.foo.com and https://www.bar.com. bar.com is the actual application, but foo is where the clients would prefer applicants log in. Historically I have logged in at http://www.bar.com, but now wish to create a form on foo.com to login to bar.com that passes the login to bar.com securely. If there is an error with the info entered into foo.com, i’d like to redirect to bar.com.

[both sites are https]

I’ve got a form built for the clients, but certainly don’t want to send passwords in clear text.

clarification The form is to be given to multiple clients that they will then put on their own page to login to the actual application. The clients are SaaS, that no longer want the company that “does all the lifting” to be what their clients log into

Answer 1

It doesn’t sound as though you need any complicated server-side solution for this. Just copy the form from bar.com to foo.com, and modify the action attribute of the form element to start with https://bar.com/. No other changes would likely be necessary, and this would be no less secure than logging in on bar.com directly.