2

Is it possible to dynamically include/exclude blocks somehow using env variables or the like? Something in the lines of

<LocationMatch ...>
  SetEnvIf X-Requested-With XmlHttpRequest xhr
  <If xhr>
    SSLVerifyClient none
  </If>
  <If !xhr>
    SSLVerifyClient optional
  </If>
</LocationMatch>
1
  • Why not just place the AJAX endpoints on another location? The user won't see their URLs anyway.
    – joschi
    Sep 7, 2010 at 5:35

2 Answers 2

1

In response to what you're trying solve given the Apache snippet rather than the actual question:

You can't enforce Client Certs after SSL handshake has taken place and certainly not after inspection of the HTTP headers, so your idea is not possible.

Further more, SSLVerifyClient optional is not supported by any mainstream browser and leads to strange SSL connect errors.

The only way to do this on the server side is to create a separate vhost dedicated to XHR requests.

However, on the client side have you tried xhr.withCredentials = true. From memory, this sends the client certs and any other auth data with the XHR request.

0

You mean like this?

1
  • 1
    I would prefer to use "standard" modules. Would that directive actually work on a per-request basis? I want to configure stuff differently depending on HTTP headers.
    – penmark
    Apr 29, 2010 at 15:41

You must log in to answer this question.