绕过特定URI(包括查询字符串)的.htaccess授权 - Bypass .htaccess authorization for specific URI including query strings

Bypass .htaccess authorization for specific URI including query strings

我有一个基于各种查询字符串加载的PHP web应用程序。除非传递了特定的查询字符串，否则我需要应用程序要求身份验证。

例如，URL为example.com/app/?Setting1=trueI want to force authentication.

但是，如果URL是example.com/app/?Setting1=true&Setting2=true我想绕过认证

我接近我想要使用SetEnvIf Request_URI，但我不确定如何将查询字符串变量包含到Request_URI。

SetEnvIf Request_URI "(/app/test)$" allow
Order Deny,Allow
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/path/.htpasswd
AuthGroupFile /dev/null
#Allow valid-user
Deny from all
Allow from env=allow
Satisfy any

我想要这样的东西:

SetEnvIf Request_URI "(/app/?Setting1=true&Setting2=true)$" allow
Order Deny,Allow
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/path/.htpasswd
AuthGroupFile /dev/null
#Allow valid-user
Deny from all
Allow from env=allow
Satisfy any

非常感谢您的建议。

RewriteEngine On
SetEnvIf Request_URI ".*" allow=0
RewriteCond %{QUERY_STRING} ^(?:.*[&?])?Setting1=true&Setting2=true$
RewriteRule ^ - [E=allow:1]
RewriteCond %{QUERY_STRING} ^(?:.*[&?])?Setting2=true&Setting1=true$
RewriteRule ^ - [E=allow:1]
<If "%{ENV:allow} == '0'">
        AuthUserFile /home/path/.htpasswd
        AuthType Basic
        AuthName "Restricted Access"
        Require user valid-user
</If>

注意:

SetEnvIf不支持查询字符串参数。请参考以下链接:

mod_setenvif

也可以使用mod_rewrite模块设置环境变量:

mod_rewrite