Received: from netrinsics.com (robinson@[210.74.177.24])
	by hub.org (8.9.2/8.9.1) with ESMTP id BAA14340
	for <pgsql-interfaces@postgreSQL.org>;
	Thu, 15 Apr 1999 01:36:21 -0400 (EDT)
	(envelope-from robinson@netrinsics.com)
Received: (from robinson@localhost)
	by netrinsics.com (8.9.2/8.8.7) id NAA00398;
	Thu, 15 Apr 1999 13:36:25 +0800 (CST) (envelope-from robinson)
Date: Thu, 15 Apr 1999 13:36:25 +0800 (CST)
From: Michael Robinson <robinson@netrinsics.com>
Message-Id: <199904150536.NAA00398@netrinsics.com>
To: pgsql-interfaces@postgreSQL.org, ser@nsu.ru
Subject: Re: [INTERFACES] WEB-interface
In-Reply-To: <003101be86fe$963a9770$59d17cc1@cnit.nsu.ru>

"Sergei Chernev" <ser@nsu.ru> writes:
>But if I want to create subform, I have to know username/password again.
>Now, I'm solving this problem transmitting <input type="hidden"> back
>to client - but this method is wrong.

Make an MD5 checksum of the username, password, and current time.  Send the
MD5 checksum in a hidden field (or use a cookie).  Keep a server-side cache
of the currently valid checksums (expire the old ones periodically), and 
check the incoming checksum against the cache for each request.

	-Michael Robinson