Exception in .htaccess when accessing passworded URI for REST API - PeakU

0

233

Views

Exception in .htaccess when accessing passworded URI for REST API

I have set password authentication for website in .htaccess and would like to make an exception when the incoming request is for particular URI. Basically it works until one point.

The .htaccess looks like this:

AuthType Basic
AuthName "Password"
AuthBasicProvider web-user
<RequireAny>
        Require valid-user
        Require env let_me_in
</RequireAny>

I've added:

SetEnvIf Request_URI "/path1/path2/?rest" let_me_in

but in this case the questionmark is being omitted and authorizes me without password for /path1/path2/rest but not for /path1/path2/?rest

if I change it to include an escape character like this:

SetEnvIf Request_URI "/path1/path2/\?rest" let_me_in

it still requires authorization for /path1/path2/?rest

xxx.xxx.xxx.xxx - - [07/Apr/2020:21:01:50 +0200] "GET /path1/path2/?rest HTTP/1.1" 401 693 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/Safari"

/path1/path2/ is the root of the website

As a temporary workaround I have allowed all access for defined IP address - but this is not the desired way this should work

SetEnvIf Remote_Addr xxx.xxx.xxx.xxx let_me_in

How can I get the SetEnvIf Request_URI work correctly for this particular case?

over 4 years ago · Santiago Trujillo

Answer question

Find remote jobs