Ftp and authentication and domino questions

HCL Domino Domino Forum
1

i have a link on my site which calls an agent which does some processing before doing a

Print “<SCRIPT LANGUAGE=”“JavaScript”“>window.location.replace(”“” & loginURL & “”“)”

loginURL is an FTP url with user authentication information prepended to the URL (ftp://user:password@loginURL). Since the value of the loginURL variable is always a downloadable file, the user always gets the download dialogbox as a result of the Print statement mentioned above.

The problem is that if the user views the source HTML on the page under the download dialog box, they see the FTP URL string with the authentication information. I want to hide the authentication info. I know i could use a java fileOutputStream to achieve the same goal, but the files are huge and I would feel more secure using ftp. does anyone have any suggestions on how to get to a downloadable file which exists on a server requiring authentication (the server that the file is on is not running domino) without using Java and without exposing the authorized userid & password? Maybe a Perl/CGI solution? Thanks in advance!

2

Subject: ftp and authentication and domino questions

well FTP is not secure if you really want to compare many methods. You highlight the chief insecurity when using it with the web.

To answer your chief question about hiding, I would create a button on the form. Then have a web lotusscript agent with the FTP URL within it. Just be sure to put “[” and “]” around the whole web code. A second way to do this as well would be to have a new form laugh and on the web query open have it feed the ftp url.

But when you were able to not have the URL be shown on the webpage, people are going to find out the user:password by other means. If I have my IE prompt me to save or open the file, I am going to find out the location of the file (and see the username and password).

HTH – Cheers