Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I couldn't think of a good title for this. Basically I have basic auth that covers the whole site from /, but I want urls with certain parameters to be excluded from authentication.

Example: do not authenticate if there is a parameter named "zzz"


Not Protected

Tried doing something like

<LocationMatch "/zzz/">
  Allow from all
  Satisfy any

with now avail. From what I understand parameters do not seem to be seen by the LocationMatch, is this correct? or am I doing it all wrong?

share|improve this question
LocationMatch as well as Location directives do not work with query string parameters -- only with path part of the URL: – LazyOne Aug 9 '11 at 15:36

LocationMatch definitely cannot do this. You may be able to get the desired behavior out of mod_rewrite using the QUERY_STRING parameter, but I would still classify that as "doing it wrong" - you don't want to run into a situation where you always allow queries through without auth when ?logout=true, but then you add a page later that's not looking for the logout param in the same way.

I'd recommend changing your application to use a fake directory structure instead of just query params, or else just having your application handle all of the authentication logic itself.

share|improve this answer
I know it looks wrong, but all I need to do is hide the information that is generated when that specific parameter is set. fake directory structure sounds like the way to go – Saifis Aug 10 '11 at 4:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.