The way I handle this problem is by using Apache's built in authentication modules. There's no information a hostile site could get from your browser (well, I don't know, IE seems to like to save passwords).

Anyway, the nice thing about letting Apache do the authentication step for you is that your scripts can just concentrate on the task at hand, instead of worrying about any holes you might have left in your authentication method. All you have to do is retrieve the $ENV{'REMOTE_USER'} variable and you can be pretty sure that's who you're dealing with.

When I click on the link, information about which websites I had visited before, my IP, etc., will be sent to the "evil" website. Using that data it's able to do malicious stuff on the server I visited last, since I had already logged on before.

The only compromising data is the referrer, or the URL to which you had been to before. It cannot tell which "websites" you had visited before, only the previous page. Yes, your IP is known, but it is known anyway, to every site you visit, and to everyone you email. Furthermore, most (if not all) browsers only send the referring information if you click on a a link, not if the browser is invoked by an external program. So this is only an issue with web-based email readers.

In summary, there is nothing to worry about. Just don't put information like passwords into URLs when writing scripts (a bad idea for more than the reason mentioned here) and everything will be fine. I really doubt that any major web mail services do such a thing anyway. Such holes were patched a long time ago.

As to how to avoid them while writing scripts (which almost makes this a perl question, but not quite), just store password information on the server (best) and/or use cookies and/or use HIDDEN input tags.

Sure, there is a window of time where some tricky malicious scripting could redirect the client to do something unintended, but it's minimized somewhat here.

my $time_algo += $s for my $s @time2..5;
[download]

my $time_algo += $_ for @time2..5;
[download]

Originally posted as a Categorized Answer.

my @time = localtime();
my $time_algo = 0;
$time_algo = += $_ for @time[2..5];
my $salt = 'salty';
my $cipher = crypt($time_algo,$salt);

if ($cipher ne $current_cipher){
    #force to reidentify;
}
[download]