Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've configured basic Apache authentication for certain areas of a website that only administrators should have access to. Most web applications make this convenient by putting their admin pages in a subdirectory, so I configure authentication for the directory, such "/goodapp/admin". The problem is that some applications instead rely on the query string, eg.


Is there any way I can configure Apache to require authentication for a URL like this, based on the query string?

share|improve this question
up vote 1 down vote accepted

I did some research on this, but I don't think that Apache will let you match on the query string in a way that will allow you to conditionally require authentication. You could match on a directory or file, but not on items in a query string AFAIK (unless you are doing URL rewriting). This makes sense because you probably don't want application logic sitting in the webserver configuration.

What you could do is prepend any scripts that have admin capabilities with a check like this:

$isLoggedIn = array_key_exists('PHP_AUTH_USER', $_SERVER);
if (!$isLoggedIn && $isTryingToUseAdminFeature) {
  // redirect to login.php; this file has two properties:
  // 1) the apache conf requires authentication to access it
  // 2) it redirects the user back from whence they came

The second time around, PHP_AUTH_USER should be set and so $isLoggedIn will be true. Then in your code, you can conditionally display/allow the admin functionality.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.