I want to redirect from one webapp to another webapp ( on different domains) and need to pass token in headers ( any other suggestion for passing sensitive information without server side involvement will also be of great help).

Things I tried:-

1. Adding all data in URL params, redirecting to URL, storing them in session storage and then window.location.href = window.location.orgin.

(Problem: my token is visible in params till the time redirection happens ( also this method is to be avoided as per the requirement)

2. Passing token in cookies with window.open(url,"_blank")

   window.document.cookie = "token=loremipsum12345u89

(Problem: not able to set https cookies and in encrypted manner)

Any direction for the same problem would be helpful.