[NavinF]

With third party cookies going away, URL parameters are the only way to do SSO across domains. Not much you can do about it.

[quickthrower2]

With SAML IIRC the IdP request is GET (but hey that one is fairly public - no credentials have been supplied yet) and the response is POST back to the origin site.