Subject: Re: no fake anonymous passwords

From: Bob Luckin <[email-masked]>
Date: Wed, 6 Nov 96 15:52:55 CST

Alain said :-
> [..deleted..]
> > Browsers tend to try to supply an email address by default, which would
> > be rejected by the FTP server.  I got round the problem by writing a CGI
> > script which prompts the user for their number, and then uses this to
> > return the HTTP "Location:" header to the browser, with the password they
> > entered built in to the URL.  This seems to work fine.
> > 
> > Then instead of creating a straight link to your FTP server on the original
> > HTML page, you create a link to the CGI script instead.
> > 
> 
> My HTML and CGI is out of date but if a user specify a URL like this in
> the Web Browser:
> 
> ftp://your.host.name/pub/foo.txt

This is a good point Alain.  My original suggestion was aimed at people
putting links to specific FTP files/directories in their HTML, but you are
right.  If a user types this into a browser directly, this will always fail
to work, because they haven't supplied the password.

But...

If they type
   ftp://[email-masked]/pub/foo.txt
         ^^^
or ftp://[email-masked]/pub/foo.txt
         ^^^^^^^^^
then the browser should pop up a prompt asking them to enter their password.
This works in both Mosaic and Netscape.

You can also include URLs like this in your HTML anchors, and they'll work
the same way.  I forgot to mention this last time.  (I use a CGI script
because I want to use a cookie to save their password, so they don't have to
enter it again in a future session, but the solution above works just as
well.)

Alternatively, if the URL used is (whether they type it or follow a link)
   ftp://ftp:[email-masked]/pub/foo.txt
         ^^^ ^^^^^^^^
they will get the file straightaway, without seeing the dialog box, because
they have already supplied the password.

> What I mean is: once they pass the CGI script and enter
> FTP, when they save the link in their Bookmarks .. It will
> show:
> ftp://hostname...
> ^^^

In the above cases, the URL saved will be
   ftp://[email-masked]/pub/foo.txt
or
   ftp://ftp:[email-masked]/pub/foo.txt
as appropriate, and so the bookmark will work when they use it - it's the
same as what they typed in the first time.

The same thing happens when they use my CGI script which builds the URL
for them - it gets saved as
   ftp://ftp:[email-masked]/pub/foo.txt
in the bookmark file, so no problem...

Cheers, Bob
-- 
Bob Luckin                   EDA Systems Distribution and Billings team
Texas Instruments
P O Box 650311, MS 3937      MSG: VOLY              Email: [email-masked]
Dallas, TX 75265   U.S.A.    Tel: (972) 917 5081    Fax: (972) 917 7966

---

From: Alain Magloire <[email-masked]>
Date: Wed, 6 Nov 1996 18:26:03 -0500 (EST)

Thank You, `Bob Luckin', for the explainations.

  It cleared some questions. I realise, that I didn't
do my homeworks with HTTP/1.1|URL|COOKIES I would be curious
to see your CGI script and probably other member of this list
too... if it's available ;-) If not, thanks again.

--
alain

---

From: Bob Luckin <[email-masked]>
Date: Wed, 6 Nov 96 17:44:58 CST

Alain said :-
> Thank You, `Bob Luckin', for the explainations.

You're welcome !

> too... if it's available ;-) If not, thanks again.

Hmm.  It doesn't contain anything which could be classed as a technical
secret, but knowing company beaurocracy I probably ought to clear it
with someone first...  :-(  I'll try and see how easy this is, but no
promises.

If there is enough interest I'll see what I can do, although I'm about to
go off-site for a week, so it'll be some time before I can get round to it.

Cheers, Bob