Restrict acess Basic Auth to all but one file+query string - apache

Question

I need to prevent access to all files in a dir but one specific file, with a specific query string. I've been trying this so far, but I REQUEST_URI doesn't have the QUERY STRING
SetEnvIf Request_URI ^index.php?myquery$ noauth=1
AuthType Basic
AuthUserFile /home/user/.htpasswd
AuthName "Pass"
Order Deny,Allow
Satisfy any
Deny from all
Require valid-user
Allow from env=noauth
Again, the user should only be able to access index.php?myquery. Not index.php or anything.php?myquery

Answer 1

SetEnvIf cannot access the query string in Apache 2.2. In 2.4, you could access the query string in a 2nd SetEnvIf or just use <if>
Here's a simple example in mod_rewrite though that works in 2.2 vhost context:
RewriteEngine ON
RewriteCond %{REQUEST_URI} =/index.php
RewriteCond %{QUERY_STRING} =myquery
RewriteRule .* - [E=noauth:1]
Note: doesn't work in htaccess/per-dir context

Answer 2

Don't think you can do what you want here since you can't use mod_rewrite to alter the request (auth module happens before rewrite module) and you can't match against the query string in the request URI. You may need to do something with some redirect trickery, maybe something like:
make a symlink of index.php called index2.php (so that they are the same file)
make the SetEnvIf call match simply ^/index.php
Within the index.php script (probably near the very top), have it look for whether or not there's a myquery query string, and if not, redirect the request to /index2.php
When the browser is told to go to /index2.php instead, it gets asked for authentication
If the browser enters the correct auth, index.php gets executed (because of step #1).

Answer 3

If you are using Apache 2.4, SetEnvIf and mod_rewrite workarounds are no longer necessary since the Require directive is able to interpret expressions directly:
Apache 2.4 treats Require directives that are not grouped by as if they were in a , which behaves as an "or" statement.
Allow access to /callbacks/foo
Require expr %{REQUEST_URI} =~ m#^/callbacks/.*#
Require valid-user
Allow access to /callbacks/foo?secret_var=42 :
Require expr %{QUERY_STRING} = 'secret_var=42'
Require valid-user
This example would allow access to /callbacks/foo?secret_var=42 but require a username and password for /callbacks/foo :
<RequireAny>
<RequireAll>
# I'm using the alternate matching form here so I don't have
# to escape the /'s in the URL.
Require expr %{REQUEST_URI} =~ m#^/callbacks/.*#
Require expr %{QUERY_STRING} = 'secret_var=42'
</RequireAll>
Require valid-user
</RequireAny>
More examples.