apache password protect specific URL - apache

Question

I need to password protect on specific URL, for instance anyone can access index.php but as soon as they add parameters or "GET" variables I must require valid-user.
index.php -> sweet
index.php?prev=1 -> require valid user

Answer 1

Interesting question.
Here's a solution:
<Location /fakeindex.php>
Order Deny,Allow
Deny from All
Allow from env=REDIRECT_STATUS
AuthType Basic
AuthUserFile /pathto/htpasswd/file/passwords.secret
AuthName This is an example auth
Require valid-user
</Location>
<Directory /path/to/doc/root>
Order allow,deny
allow from all
RewriteEngine On
RewriteCond %{QUERY_STRING} .
RewriteCond %{REQUEST_URI} index.php
RewriteRule .* fakeindex.php [L,QSA]
</Directory>
This part:
Order Deny,Allow
Deny from All
Allow from env=REDIRECT_STATUS
is there to prevent a direct access to /fakeindex.php (but in fact who would like to enforce a direct access to a protected zone). It's optionnal.
The key point is that theses condition Rules detect a non empty Query string, and a request to index.php:
RewriteCond %{QUERY_STRING} .
RewriteCond %{REQUEST_URI} index.php
And that if they match the Rule:
RewriteRule .* fakeindex.php [L,QSA]
Redirect internally the request to /fakeindex.php, keeping the query string with QSA. After that the Location is applied, and authentification is on the Location.

Answer 2

You could use the isset() method on the get variable eg:
if (isset($_GET['prev'])) {
//load password input form
}