0

I am developing on my local PC but it's setup so that it is listening on external IP, so anyone can hit my apache is they know the port number.

I want to implement a quick solution to prevent other developers from accessing my development PC.

This is want to do: I want to require that a http request contains specific custom header and if it's not present then reject the request and ideally will also log this as error.

For example, I want to require http header x-developer with value of 'myname' it header x-developer is not present or value is not 'myname' then reject the request On the front-end I will use chrome extension that sets custom request header, called "Extra Headers"

How can I do this in Apache 2?

Are there any extra modules that required for this?

Improve this question
3
  • Is there a reason you can't set up a firewall rule restricting access to your PC on port 80 to localhost?
    – ArgumentBargument
    Feb 12, 2014 at 15:46
  • I think firewall is even more complicated. I want to be able to hit my PC from other IPs inside our network but still must sent this extra header. Some requests will be routed by the corporate router to apache running on my pc.
    – Dmitri
    Feb 12, 2014 at 15:50
  • To clarify the apache on my pc is listening to external IPs only inside our corporate network, not really accissible to the outside world, but our corporate network is huge
    – Dmitri
    Feb 12, 2014 at 15:51

2 Answers 2

Reset to default
4 
RewriteEngine on
RewriteCond %{HTTP:X-Developer} ^myname$
RewriteRule .? - [E=headerok]

Order deny,allow
Deny from all
Allow from env=headerok

See the mod_rewrite documentation for information about the %{HTTP} match in RewriteCond, and E option in RewriteRule.

I assume you know that this is a weak form of security, easily spoofed by anyone who can sniff your network traffic.

Improve this answer
2
  • I know this is not really security, something very simple. I can't password-protect my site because an internal corporate route will route certain requests to my PC.
    – Dmitri
    Feb 12, 2014 at 15:53
  • Your order is wrong, should be deny,allow
    – Dmitri
    Feb 12, 2014 at 16:24
1

Make your Apache listen only on localhost.

Improve this answer
4
  • Are how would others be able to access my server then?
    – Dmitri
    Feb 12, 2014 at 15:51
  • 1
    @Dmitri - you stated you did not want others to access it... check your post, you don't define this clearly. You say you don't want the other developers to access it.
    – ETL
    Feb 12, 2014 at 16:22
  • @Dmitri what Andrew Schulman listed there should work to do it the way you wanted. Not sure how that will allow others but not the developers to access it though... I guess "others" will set the "x-developer" header?
    – ETL
    Feb 12, 2014 at 16:23
  • I want to be able to access it myself by from other ips. Basically this is a measure to reduce the annoyances of having other people hitting my development server and polluting my dev log
    – Dmitri
    Feb 12, 2014 at 16:26

Not the answer you're looking for? Browse other questions tagged .