Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I couldn't think of a good title for this. Basically I have basic auth that covers the whole site from /, but I want urls with certain parameters to be excluded from authentication.

Example: do not authenticate if there is a parameter named "zzz"

Protected
http://example.com/
http://example.com/?xxx=xxx&yyy=yyy

Not Protected
http://example.com/?zzz=zzz
http://example.com/?xxx=xxx&zzz=zzz

Tried doing something like

<LocationMatch "/zzz/">
  Allow from all
  Satisfy any
</LocationMatch>

with now avail. From what I understand parameters do not seem to be seen by the LocationMatch, is this correct? or am I doing it all wrong?

share|improve this question
1  
LocationMatch as well as Location directives do not work with query string parameters -- only with path part of the URL: httpd.apache.org/docs/current/mod/core.html#location. –  LazyOne Aug 9 '11 at 15:36
add comment

1 Answer

LocationMatch definitely cannot do this. You may be able to get the desired behavior out of mod_rewrite using the QUERY_STRING parameter, but I would still classify that as "doing it wrong" - you don't want to run into a situation where you always allow queries through without auth when ?logout=true, but then you add a page later that's not looking for the logout param in the same way.

I'd recommend changing your application to use a fake directory structure instead of just query params, or else just having your application handle all of the authentication logic itself.

share|improve this answer
    
I know it looks wrong, but all I need to do is hide the information that is generated when that specific parameter is set. fake directory structure sounds like the way to go –  Saifis Aug 10 '11 at 4:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.