Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to dynamically include/exclude blocks somehow using env variables or the like? Something in the lines of

<LocationMatch ...>
  SetEnvIf X-Requested-With XmlHttpRequest xhr
  <If xhr>
    SSLVerifyClient none
  </If>
  <If !xhr>
    SSLVerifyClient optional
  </If>
</LocationMatch>
share|improve this question
    
Why not just place the AJAX endpoints on another location? The user won't see their URLs anyway. –  joschi Sep 7 '10 at 5:35
add comment

2 Answers 2

In response to what you're trying solve given the Apache snippet rather than the actual question:

You can't enforce Client Certs after SSL handshake has taken place and certainly not after inspection of the HTTP headers, so your idea is not possible.

Further more, SSLVerifyClient optional is not supported by any mainstream browser and leads to strange SSL connect errors.

The only way to do this on the server side is to create a separate vhost dedicated to XHR requests.

However, on the client side have you tried xhr.withCredentials = true. From memory, this sends the client certs and any other auth data with the XHR request.

share|improve this answer
add comment

You mean like this?

share|improve this answer
1  
I would prefer to use "standard" modules. Would that directive actually work on a per-request basis? I want to configure stuff differently depending on HTTP headers. –  penmark Apr 29 '10 at 15:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.