SetEnvIf cookie "(^| )cookie=mycookievalue($|;)" pass
order deny,allow
deny from all
allow from env=pass
I am extremely curious why the change
That makes two of us.
There are actually two changes. The other involves a change from "deny from env=blahblah" to “deny from all” -- but with an order "deny,allow" that shouldn't make a difference, and in fact it's the "allow" part that's relevant.
The significant change is from
cookie=mycookievalue
to
(^| )cookie=mycookievalue($|;)
:: detour to check something ::
Ah. Multiple cookies in the "Cookie" header are separated by "; " (semicolon, space).
It's analogous to the formulation you'd use in, for example, looking at query strings in mod_rewrite, where you might say (^|&
)parameter=value(&|$) if you needed to constrain name and value to exact strings, and the whole thing might occur initially, medially or finally. But there the parenthesized bits are optional--at least I always thought they were--because anchors are only relevant if some parameters have overlapping names, or if it's important to consider the full and exact value.
To appease everyone's curiosity, would you care to do a bit more experimenting? Verify that both anchors--before (^| ) and after ($|;
)--are necessary in order to make the rule work. It's possible that a newer Apache version has changed the way it interprets the Cookie header, though you'd think they would say so somewhere. Hmph.
If your host is coy about what Apache version you're on, there are some simple tests you can do to pin it down. Simplest is to check for the various versions of mod_authwhatsit, since they tend to get a new name each time.
Incidentally, if you have a fixed IP, the rule could be expressed as
Deny from all
Allow from 11.22.33.44 (your exact IP)
It doesn't have to be fixed-as-such (your ISP may charge extra, depending on connection type); it's enough if you've found by experiment that your IP hardly ever changes. This obviously will not work if you are on AOL dialup ;)
:: final smiley added to placate Forums after ruthlessly inserting [ b][ /b] everywhere else ::
