Topic: How to limit access to an URL with query parameters

[juza]

Hello,

my experience with apache is ~ 0 and I need your help. My problem is the following:

I need that an URL is accessible only for some defined users. In the URL there is a query parameter and that is the discriminator.

The URL could be something like this:

https://my.my.com/my-app/view/myView.xhtml?myQueryParam=allUsers

Googling a little I came upon this possible solution:

RewriteEngine on
RewriteCond %{REQUEST_URI} "/my-app/view/myView[.]xhtml.*"
RewriteCond %{QUERY_STRING} myQueryParam=allUsers
RewriteRule .* - [E=no_auth_required:1]

<LocationMatch "/my-app/view/myView[.]xhtml.*">

Require uniqueID user1ID user2ID

</LocationMatch>

Between xhtml and ? could come additional strings too, therefor the *

This works but the problem is that it also denies the access to for ex. the link https://my.my.com/my-app/view/myView.xhtml?myQueryParam=somethingElse

It seams that it doesn't bother the value of the query parameter...

What do I miss?

Thank you in advance.

Greetings
Francesco

[James Blond]

if you are using 2.4.x

[juza]

Nope. I'm using Apache 2.2

I saw that with 2.4 it would be easier...

[James Blond]

Can't you handle that in your app? So your app checks for the query string?

[juza]

I just need a quick and dirty solution. Afterwards I can update my application too.

[James Blond]

See http://serverfault.com/questions/436312/how-to-only-allow-urls-with-specific-parameter-in-apache