I was thinking something more like a variable accessible just from Perl. Something no different than using a PerlAccessHandler with mod_perl a la:

sub authen_handler {
  
        my $r = shift;
  
        # get user's authentication credentials
        my ($res, $password) = $r->get_basic_auth_pw;
        return $res if $res != OK;
        my $user = $r->connection->user;
  
        # authenticate through DBI
        my $reason = authen_dbi($r, $user, $sent_pw);
  
        if ($reason) {
                $r->note_basic_auth_failure;
                $r->log_reason($reason, $r->uri);
                return AUTH_REQUIRED;
        }
        return OK;
    }
[download]

I am not sure I understand how setting an environment variable would make a network insecure even if the variable is a user's password. If the password is sent over SSL and only accessible from the Perl CGI that accessed it, what insecurities would result?

enoch