Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to dynamically include/exclude blocks somehow using env variables or the like? Something in the lines of

<LocationMatch ...>
  SetEnvIf X-Requested-With XmlHttpRequest xhr
  <If xhr>
    SSLVerifyClient none
  <If !xhr>
    SSLVerifyClient optional
share|improve this question
Why not just place the AJAX endpoints on another location? The user won't see their URLs anyway. – joschi Sep 7 '10 at 5:35

In response to what you're trying solve given the Apache snippet rather than the actual question:

You can't enforce Client Certs after SSL handshake has taken place and certainly not after inspection of the HTTP headers, so your idea is not possible.

Further more, SSLVerifyClient optional is not supported by any mainstream browser and leads to strange SSL connect errors.

The only way to do this on the server side is to create a separate vhost dedicated to XHR requests.

However, on the client side have you tried xhr.withCredentials = true. From memory, this sends the client certs and any other auth data with the XHR request.

share|improve this answer

You mean like this?

share|improve this answer
I would prefer to use "standard" modules. Would that directive actually work on a per-request basis? I want to configure stuff differently depending on HTTP headers. – penmark Apr 29 '10 at 15:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.