Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am developing on my local PC but it's setup so that it is listening on external IP, so anyone can hit my apache is they know the port number.

I want to implement a quick solution to prevent other developers from accessing my development PC.

This is want to do: I want to require that a http request contains specific custom header and if it's not present then reject the request and ideally will also log this as error.

For example, I want to require http header x-developer with value of 'myname' it header x-developer is not present or value is not 'myname' then reject the request On the front-end I will use chrome extension that sets custom request header, called "Extra Headers"

How can I do this in Apache 2?

Are there any extra modules that required for this?

share|improve this question

closed as off-topic by Iain, Katherine Villyard, TheCleaner, Ward, mdpc Feb 14 '14 at 19:20

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Ward, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

Is there a reason you can't set up a firewall rule restricting access to your PC on port 80 to localhost? – ArgumentBargument Feb 12 '14 at 15:46
I think firewall is even more complicated. I want to be able to hit my PC from other IPs inside our network but still must sent this extra header. Some requests will be routed by the corporate router to apache running on my pc. – Dmitri Feb 12 '14 at 15:50
To clarify the apache on my pc is listening to external IPs only inside our corporate network, not really accissible to the outside world, but our corporate network is huge – Dmitri Feb 12 '14 at 15:51
up vote 1 down vote accepted
RewriteEngine on
RewriteCond %{HTTP:X-Developer} ^myname$
RewriteRule .? - [E=headerok]

Order deny,allow
Deny from all
Allow from env=headerok

See the mod_rewrite documentation for information about the %{HTTP} match in RewriteCond, and E option in RewriteRule.

I assume you know that this is a weak form of security, easily spoofed by anyone who can sniff your network traffic.

share|improve this answer
I know this is not really security, something very simple. I can't password-protect my site because an internal corporate route will route certain requests to my PC. – Dmitri Feb 12 '14 at 15:53
Your order is wrong, should be deny,allow – Dmitri Feb 12 '14 at 16:24
Yes, thanks. Fixed – Andrew Schulman Feb 12 '14 at 17:37

Make your Apache listen only on localhost.

share|improve this answer
Are how would others be able to access my server then? – Dmitri Feb 12 '14 at 15:51
@Dmitri - you stated you did not want others to access it... check your post, you don't define this clearly. You say you don't want the other developers to access it. – ETL Feb 12 '14 at 16:22
@Dmitri what Andrew Schulman listed there should work to do it the way you wanted. Not sure how that will allow others but not the developers to access it though... I guess "others" will set the "x-developer" header? – ETL Feb 12 '14 at 16:23
I want to be able to access it myself by from other ips. Basically this is a measure to reduce the annoyances of having other people hitting my development server and polluting my dev log – Dmitri Feb 12 '14 at 16:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.