Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following mod_rewrite rule, which works fine in my Apache 2.x on CentOS 6 Linux machine, but is not complete:

    RewriteCond %{HTTP_COOKIE} !id
    RewriteCond %{REQUEST_URI} ^/sites/default/files/pictures/picture-
    RewriteRule .* /images/dummy.png [L]

because I'm trying to change it in 2 ways:

1) Actually 2 cookies (and not just 1 as above) should be present: id and auth (but I don't know, how to do (X or Y) and Z with mod_rewrite)

2) I'd like to verify that the value of the auth cookie is a 32 hex chars string (an MD5 hash) and that the value of id cookie is numeric.

The background is that I've gotten a bill for EUR 1000,- from Getty Images, because one of the Drupal users on my server has supposedly used their picture as avatar. I'm not looking for any lawyer or pseudo-lawyer advices here, just for the way to display a dummy image instead of real user pictures to web crawlers.

And yes, I've noticed in the mod_rewrite doc, that I could pass the cookie values to an external script through mod_rewrite (for verifying the MD5 hash), but I'd like to tackle this later.


I've come up with the following

   RewriteCond %{REQUEST_URI} ^/sites/default/files/pictures/picture-
   RewriteCond %{HTTP_COOKIE} !auth=[a-fA-F0-9]{32} [OR]
   RewriteCond %{HTTP_COOKIE} !id=[0-9]+
   RewriteRule .* /images/dummy.png [L]

but I'm not sure, if the above RewriteCond's act as X and (Y or Z) or (X and Y) or Z

share|improve this question

migrated from serverfault.com Oct 18 '11 at 12:08

This question came from our site for system and network administrators.

Instead of specifying RewriteCond %{REQUEST_URI} ... it is more efficient to specify this URL pattern in the RewriteRule pattern. The RewriteRule is processed first. – w3dk Oct 31 '15 at 21:30
up vote 1 down vote accepted

How about this:

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !(^|;\s*)id=[0-9]+(;\s*)auth=[0-9a-fA-F]{32}(;\s*)
RewriteCond %{REQUEST_URI} ^/sites/default/files/pictures/picture-
RewriteRule .* /images/dummy.png [L]
share|improve this answer
Does this cover if "auth=" is in front of "id="? And is maybe \b better here, than (^|;) ? But I get your idea, thanks... – Alexander Farber Oct 18 '11 at 11:36
If the "auth" arrives in the cookie first (i.e. before "id") your rule won't work. – Olivier Pons Nov 14 '11 at 15:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.