Redirect all traffic unless they match

[speedyone]

So I would like to setup a rewrite for the dev's. We do maint on a site and they want to be sure that the site is in maint before they start. I was thinking.. That is easy. Just add a rewrite to look for a cookie and the date. SO I threw this together. The part I think can be reduced is the date. I would end up with something like this

^(0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])[- /.](19|20)\d\d$

The rewrite would look something like this.

#if you hit /testing
RewriteCond %{REQUEST_URI} ^/testing.*
#allow if coockie is present
RewriteCond %{HTTP_COOKIE} !(let_me_in(Date))
#allow if you have this ip
RewriteCond %{REMOTE_ADDR} !^10\.10\.10\.10
#all other redirect to maint page
RewriteRule (.*) maintenance.html [R,L]

I am just not sure how to set the date right so that it will check to be sure you have the right one. I want to avoid people forgetting they have this cookie and then calling me. :)

[g1smd]

Redirecting to an error page is searchengine suicide. You should serve a 503 response while the site is briefly offline. In the long term consider changing to a system where no offline time is needed for updates.

[jdMorgan]

Not sure about your cookie-date question. The pattern is dictated by the date-format you choose, and as shown is well-optimized for the mm-dd-yyyy format.

The problem would be significantly simplified by setting your cookie to expire after a few hours (say, eight to ten), renewing it as needed for your testers, and then just letting it expire. That would eliminate the need to see if the cookie was current -- you'd only have to check that it was present.

If on Apache 2.x, use

 RewriteRule ^testing - [R=503,L] 

along with your other RewriteCond qualifiers to generate a proper Server Unavailable response. Do not use a 301, 302, 303, or 307 redirect, as these will cause trouble -- as cautioned by g1smd above. If on Apache 1.x, you'll likely have to rewrite the requests to a simple script to generate a 503 response.

Jim

[speedyone]

Thanks. I will have to talk to them about this. I have been pushing for no down time but sometimes it is needed.

[g1smd]

You can get away with at least several hours downtime, especially when serving 503 responses.

The ideal is for no downtime (especially for sites that sell stuff), but there are a few occasions (especially for sites with databases) where you just have to temporarily stop all database transactions while you change something around.