There's a number of different approaches you can use for the security portion, using CGI::Session or Apache::Session for example, or .htaccess, or even a couple of post variables.

As for the serving up of a file, always send in binary mode, that way it doesn't matter if the file is text or binary; if it is text you just hope that the client knows how to deal with different newline formats.

Serving up a file consists of something like the following (which is for mod_perl, but you could apply the principles to CGI):

sub outputfile( $ $ ) {
    my $r = $_[0];     # Apache mod_perl request object
    my $view = $_[1];  # name of file to upload
    my $error = undef; # error message to return
    if ( ! -f ( "$view" ) ) {
        $error = "<p>Error, file \"$view\" could not be found</p>";
        return( $error );
    }
    my $fsize = ( stat( _ ) )[7];
    if ( ! open( INFILE, "<$view" ) ) {
        $error = "<p>Error opening file \"$view\":<br />$!</p>";
        return( $error );
    }

    # biff to output
    my %export_headers = ( "Content-Disposition" =>
                           "attachment; filename=\"$view\"",
                           "Content-Length" => $fsize,
                          );

    $r->content_type("application/octet-stream");
    $r->no_cache(0); # req for winXP that refuses to open cached pages
    eval {
        # mod_perl 1
        $r->header_out($_ => $export_headers{$_}) for 
            keys %export_headers;
    };
    if ( $@ ) {
        # mod_perl 2
        $r->headers_out->{$_} = $export_headers{$_} for 
            keys %export_headers;
    }
    my $data;
    my $result;
    while ( $result = read( INFILE, $data, 8192 ) ) {
        print( $data );
    }
    close( INFILE );
    return( undef );
}
[download]