I'm building a payment page in asp.net, however the page where you order your items is run in HTTP (non-secure) on my domain.

When redirecting the user to the payment site, I have to go through a different domain (my payment provider, from whom I borrow the SSL certificate), so my payment url ends up like https://www.paymentprovider.com/somescript.cgi/www.mydomain.com/mypaymentpage.aspx

Now the problem is my session is lost, but I store the order in session, so I desperately needs it.

Can I somehow send the SessionID in querystring, and restore the session from it - or do I need to stuff the entire order into querystring ? (Not too certain it'll fit though, it's rather long)

Any help will be highly appreciated :-)