If you've built your own server out of something like HTTP::Daemon, you can get a request object and grab the Authorization header to parse it yourself:

my $r = $daemon->get_request();
my ($username, $password) = split(/:/, $r->header('Authorization'), 2)
+;
[download]

Update:

Yeah, that did say 'REQUEST_USER' before. Sorry, I merged the right line with the description of 'REQUEST_METHOD' as I read it.