: Verify 2 cookies with mod_rewrite before serving images I have the following mod_rewrite rule, which works fine in my Apache 2.x on CentOS 6 Linux machine, but it is not complete: RewriteCond

@Alves908

but I'm not sure, if the above RewriteCond's act as X and (Y or Z) or (X and Y) or Z


In the directives you posted it is the former: X and (Y or Z)

However, as mentioned in my comment above, it is more efficient to do the URL-path check in the RewriteRule pattern - since this is what's processed first. This avoids the RewriteRule being processed for every request (as is what happens when using a catch-all pattern like .*). You then have just two ORd conditions that check the absence of either cookie (in any order). For example:

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !(^|;s*)id=[0-9]+ [OR]
RewriteCond %{HTTP_COOKIE} !(^|;s*)auth=[0-9a-fA-F]{32}
RewriteRule ^/sites/default/files/pictures/picture- /images/dummy.png [L]


The (^|;s*) pattern prefix before the cookie name is just to safeguard against the situation when you have other cookies with a similar (but longer) name. eg. uid or userauth, etc. If that is not possible then this subpattern could be omitted.

There is no need to check for (;s*) at the end of the cookie value, as in @quanta 's answer, since this is not part of the value you are trying to validate. And the Cookie: header is not expected to end with a ; anyway - so this may not even match.

Vote Up Vote Down

@Turnbaugh106

How about this:

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !(^|;s*)id=[0-9]+(;s*)auth=[0-9a-fA-F]{32}(;s*)
RewriteCond %{REQUEST_URI} ^/sites/default/files/pictures/picture-
RewriteRule .* /images/dummy.png [L]

Vote Up Vote Down