: Using mod_rewrite to check for existence of a cookie I have an 'internal' website at my company that i'd like to allow outside access to via a reverse proxy with an Apache Server. The wrinkle

@Ann8826881

You can return a "403 Forbidden" if the cookie is not set with something like the following:

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !bMOBILEUSER=TRUEb
RewriteRule ^ - [F]


The ! before the CondPattern simply negates the pattern. b is word boundary, so it will only match that exact name/value pair, anywhere in the cookie.

A single ^ (start of string anchor) for the RewriteRule pattern matches everything. A single - (hyphen) for the substitution doesn't do anything, the URL is not rewritten (but the substitution is ignored anyway when using the F flag). And the F flag results in a 403 being served (this also implies an L flag - so processing stops).

Obviously, unless you are using SSL then the cookie can be sniffed.

Vote Up Vote Down