I am confused about getting or downloading an attachment from couchdb.
One problem is, if I'm not logged in over futon, I will get error message about lacking access rights onto database and can't download the files / attachment directly.
I use for my php scripts following scripts to communicate with couchdb:
Php-On-Couch and my php version is at 5.3.
If these scripts are online, it is very risky to give complete url to visitors, because they can see loginname and password.
What options do I have now?
You are correct. Do not give usernames and passwords to users.
I am not sure, however you might want to make the user log in to CouchDB. (They can log in via Futon, or you can create a nice-looking login form with no Futon.)
Please see Jan's article about the CouchDB security system. It is very complete.
in this case your PHP script should act as a "proxy" between your couch and the browser. PHP on couch support accessing a couch database with a user and a password ( just use $client = new couchClient("http://user:password@couchserver.com:5984/","mydb");
Your PHP script then needs to get the file from the DB and send it to the browser.
Regards,
Mickael