I have an internal website at my company that I'd like to allow outside access to via a reverse proxy with an Apache Server.

The difficulty here is that I only want particular mobile users accessing this reverse proxy.

I've created a very generic mobile app that will ALWAYS pass a cookie like MOBILEUSER=TRUE.

Is it possible to write a mod_rewrite rule to check for the existence of that cookie and ONLY allow requests with that cookie and value through?

1 Answer 1


You can return a "403 Forbidden" if the cookie is not set with something like the following:

RewriteEngine On
RewriteRule ^ - [F]

The ! before the CondPattern simply negates the pattern. \b is word boundary, so it will only match that exact name/value pair, anywhere in the cookie.

A single ^ (start of string anchor) for the RewriteRule pattern matches everything. A single - (hyphen) for the substitution doesn't do anything, the URL is not rewritten (but the substitution is ignored anyway when using the F flag). And the F flag results in a 403 being served (this also implies an L flag - so processing stops).

Obviously, unless you are using SSL then the cookie can be sniffed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.