It sounds like you're talking about the IE "open
cookie jar" bug. If you're using IE, this could happen
to you I suppose. It's definitely not a good thing
to store usernames and passwords in cookies, but a
lot of sites do it anyway.
The way I handle this problem is by using Apache's built
in authentication modules. There's no information
a hostile site could get from your browser (well, I
don't know, IE seems to like to save passwords).
Anyway, the nice thing about letting Apache do the
authentication step for you is that your scripts
can just concentrate on the task at hand, instead
of worrying about any holes you might have left in
your authentication method. All you have to do is
retrieve the $ENV{'REMOTE_USER'} variable and you
can be pretty sure that's who you're dealing with.
