Using mod_rewrite to check for existence of a cookie

Question

I have an internal website at my company that I'd like to allow outside access to via a reverse proxy with an Apache Server.

The difficulty here is that I only want particular mobile users accessing this reverse proxy.

I've created a very generic mobile app that will ALWAYS pass a cookie like MOBILEUSER=TRUE.

Is it possible to write a mod_rewrite rule to check for the existence of that cookie and ONLY allow requests with that cookie and value through?

Answer 1

You can return a "403 Forbidden" if the cookie is not set with something like the following:

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !\bMOBILEUSER=TRUE\b
RewriteRule ^ - [F]

The ! before the CondPattern simply negates the pattern. \b is word boundary, so it will only match that exact name/value pair, anywhere in the cookie.

A single ^ (start of string anchor) for the RewriteRule pattern matches everything. A single - (hyphen) for the substitution doesn't do anything, the URL is not rewritten (but the substitution is ignored anyway when using the F flag). And the F flag results in a 403 being served (this also implies an L flag - so processing stops).

Obviously, unless you are using SSL then the cookie can be sniffed.