1

Rather than Apache's proxy_pass directive use a mod_rewrite rule. The mod_rewrite [P | proxy] target provides similar functionality as Apache's proxy_pass directive. I.e. something along the lines of: (un-tested and probably not immediately suitable for your purposes) RewriteCond %{HTTP_COOKIE} cookiename=([^;]+) [NC] RewriteRule "/foo/bar/(.*)$" "http://...


1

You can't do this by only sending the 401 Unauthorised response (as @davidgo has already pointed out). However, you can't just send another 4xx status instead either; you need both. You need HTTP Basic Authentication (ie. a potential "401 Unauthorized" response) when the Authorization HTTP request header is sent from your software, but respond with a 403 ...


1

I don't think this is possible. According to https://httpstatuses.com/401 a 401 error must be sent with a WWW-authenticate field, which will likely prompt a dialogue box (maybe you could try an unknown authentication type but my guess is that won't work reliably) There are a large number of 400 series status codes (https://httpstatuses.com/ ) - why not use ...


Only top voted, non community-wiki answers of a minimum length are eligible