private projects - authentication w/ RSS feeds incompatible with RSS aggregators

[peterleonard]

Requiring authenticated cookies to retrieve RSS feeds for private projects is incompatible with most RSS aggregators. For example, using Yahoo, Netvibes, or Google Reader doesn't work with private projects. There is, however, a desire for a public RSS feed for an otherwise-private project.

It's a common problem, and is handled elsewhere (e.g. Google Calendars) by adding an identifier and cryptographic checksum to the URL string, and using that as validation instead. For example:

sitename.com/port/app/projects/feeds/PROJECTID/USERID/crypto_string

where crypto_string could be something like the md5sum of PROJECT_ID, USERID and some secret key.

Thoughts?

Other note is that any FORBIDDEN message relating to RSS feeds should be sent as an RSS feed and not as an HTML page.

[peterleonard]

Is it better to open up tickets on the CPAN side of things, rather than here?