Query-String-Based Apache Authentication

The <Location>, <LocationMatch>, <Directory> and <DirectoryMatch> Apache directives allow us to apply authentication/authorization to specific patterns of resources with a high degree of specificity, but do not give us that control down to the query-string level.  Today we learn how to use mod_rewrite, environment variables, and the Satisfy directive to allow us to attain that goal!

Do this:

RewriteEngine on
RewriteCond %{QUERY_STRING} action=secret_admin
RewriteRule ^/app/.*$ - [E=app_auth_required:1]

<directory /root/of/your/app>
      Order deny,allow
      Deny from env=app_auth_required
      AuthType Basic
      AuthName "Login Required"
      AuthUserFile some_htpasswd_file
      require valid_user
      Satisfy any
</directory>


To break it down, the RewriteCond gives us access to that meaty query-string information.  In this case, we are matching when a string contains "action=secret_admin" in conjunction with the URL starting with "/app".  The RewriteRule does nothing to the URL (as noted by the "-"), but it does set an environment variable for the duration of the HTTP request.

The second section you might recognize as your standard Apache authentication block, but with a couple additions.  The "Deny from env=app_auth_required" checks for the existence of the environment variable set (or not set) above.  In the affirmative case (being that the environment variable exists and the request is denied) the "Satisfy Any" directive causes Apache to try the other form of authorization to grant access (the Require directive).

If the URL of the request were to contain a query string of the form "action=something_else", the Deny directive is not applied, and so the access criteria is met immediately.  Further authorization is not required.

I love Apache!