Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've configured basic Apache authentication for certain areas of a website that only administrators should have access to. Most web applications make this convenient by putting their admin pages in a subdirectory, so I configure authentication for the directory, such "/goodapp/admin". The problem is that some applications instead rely on the query string, eg.

/badapp/index.php?page=admin

Is there any way I can configure Apache to require authentication for a URL like this, based on the query string?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

I did some research on this, but I don't think that Apache will let you match on the query string in a way that will allow you to conditionally require authentication. You could match on a directory or file, but not on items in a query string AFAIK (unless you are doing URL rewriting). This makes sense because you probably don't want application logic sitting in the webserver configuration.

What you could do is prepend any scripts that have admin capabilities with a check like this:

$isLoggedIn = array_key_exists('PHP_AUTH_USER', $_SERVER);
if (!$isLoggedIn && $isTryingToUseAdminFeature) {
  // redirect to login.php; this file has two properties:
  // 1) the apache conf requires authentication to access it
  // 2) it redirects the user back from whence they came
}

The second time around, PHP_AUTH_USER should be set and so $isLoggedIn will be true. Then in your code, you can conditionally display/allow the admin functionality.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.