FirstSearch via WWW: automatic login?

[JQ Johnson]

Following David Wuolu's post to web4lib I copied and tried out the
WebScript package.  Works fine in my environment.  Note that on some
servers CGI scripts are recognized only if they have the blessed
file extension, so the fs.scr CGI script needs to be renamed, e.g. 
fs.cgi.  And you need to be sure that file protections are correct: 
	chmod 111 fs.scr WebScript

I had previously been using a perl script with similar functionality
that I'd thrown together.  If anywone wants a copy of my perl script
let me know.  If you plan to use webscript for anything other than the
fs.scr application, you should seriously consider using a more powerful
scripting language like perl instead of WebScript.

One functional difference between my perl cgi script and the one OCLC
provided is that I bypassed the T&C screen and took patrons directly to
the areas web page.  Our patrons find that the amount of fine print on
the T&C page is offputting; a repeat user of FirstSearch shouldn't have
to put up with seeing the terms each time she logs in.

More importantly, as John Lewis notes, this scheme for autologin to
FirstSearch has non-trivial security flaws if the script is being run
on a timesharing system.  It's also slow -- FirstSearch web access is
bad enough, and this adds yet another round trip to the user's startup
time.  And it's fragile -- it depends on OCLC not changing the details
of the implementation of their FirstSearch logins.  I'd strongly
recommend that if OCLC is willing to allow site-based (IP-address
based) web access that they provide this option themselves.

 JQ Johnson                       office: 115F Knight Library
 Academic Education Coordinator   Internet: jqj at darkwing.uoregon.edu
 1299 University of Oregon        voice: 541.346.1746
 Eugene, OR  97403-1299           fax: 541.346.3485