apache: pass env variables

Question

I have a rewrite rule to fetch some data from remote url(on a different server under my control) as follows:

RewriteRule ^/.+/remote_dir/(.*) http://11.22.33.44/remote_dir/$1 [P]

The remote server has htpasswd authentication which needs to be bypassed for this particular request. I cant use allow from ip as ip logged is of gateway (which will allow passwordless access to all machine behind the gateway).

So I thaught of passing env variable with this request and based on the its value bypass authentication (11.22.33.44 is also on apache).

But I cant seem to find a solution for this problem. I know there are other solutions like using common ldap auth/ or same user/pass on both servers but I dont want to use it as 11.22.33.44 is on a public ip(cloud infrastructure).

Kindly help me with a solution for this.

Answer 1

You can't pass environment variables across HTTP. Have you tried proxying with the auth tokens in the URL:

RewriteRule ^/.+/remote_dir/(.*) http://user:s3cr3t@11.22.33.44/remote_dir/$1 [P]

Aternatively you could append an authentication token to the query string, something like:

RewriteRule ^/.+/remote_dir/(.*\?.*)$ \
     http://11.22.33.44/remote_dir/$1;auth=s3cr3t [P,S=1]
RewriteRule ^/.+/remote_dir/(.*) \
     http://11.22.33.44/remote_dir/$1?auth=s3cr3t [P]

However HTTP authentication, even if digest mode, is not exactly secure.