<?xml version='1.0' encoding='UTF-8' ?>

<!DOCTYPE manualpage SYSTEM "/style/manualpage.dtd">

<?xml-stylesheet type="text/xsl" href="/style/manual.en.xsl"?>

<manualpage metafile="access.xml.meta">

<parentdocument href="./">How-To / Tutorials</parentdocument>

<title>Access Control</title>

<summary>

<p>Access control refers to any means of controlling access to any

resource. This is separate from <a

href="auth.html">authentication and authorization</a>.</p>

</summary>

<section id="related"><title>Related Modules and Directives</title>

<p>Access control can be done by several different modules. The most

important of these are <module>mod_authz_core</module> and

<module>mod_authz_host</module>. Also discussed in this document

is access control using <module>mod_rewrite</module>.</p>

</section>

<section id="host"><title>Access control by host</title>

<p>

If you wish to restrict access to portions of your site based on the

host address of your visitors, this is most easily done using

<module>mod_authz_host</module>.

</p>

<p>The <directive module="mod_authz_host">Allow</directive> and

<directive module="mod_authz_host">Deny</directive> directives let

you allow and deny access based on the host name, or host

address, of the machine requesting a document. The

<directive module="mod_authz_host">Order</directive> directive goes

hand-in-hand with these two, and tells Apache in which order to

apply the filters.</p>

<p>The usage of these directives is:</p>

<example>

Require host <var>address</var><br />

Require ip <var>ip.address</var>

</example>

<p>In the first form, <var>address</var> is a fully qualified

domain name (or a partial domain name); you may provide multiple

addresses or domain names, if desired.</p>

<p>In the second form, <var>ip.address</var> is an IP address, a

partial IP address, a network/netmask pair, or a network/nnn CIDR

specification. Either IPv4 or IPv6 addresses may be used.</p>

<p>For example, if you have someone spamming your message

board, and you want to keep them out, you could do the

following:</p>

<example>

Require not ip 10.252.46.165

</example>

<p>Visitors coming from that address will not be able to see

the content covered by this directive. If, instead, you have a

machine name, rather than an IP address, you can use that.</p>

<example>

Require not host <var>host.example.com</var>

</example>

<p>And, if you'd like to block access from an entire domain,

you can specify just part of an address or domain name:</p>

<example>

Require not ip <var>192.168.205</var><br />

Require not host <var>phishers.example.com</var> <var>moreidiots.example</var><br />

Require not gov

</example>

<p>Use of the <directive

module="mod_authz_core">RequireAll</directive>, <directive

module="mod_authz_core">RequireAny</directive>, and <directive

module="mod_authz_core">RequireNone</directive> directives may be

used to enforce more complex sets of requirements.</p>

</section>

<section id="env"><title>Access control by environment variable</title>

<p>Using the <directive type="section" module="core">If</directive>,

you can allow or deny access based on arbitrary environment

variables or request header values. For example, to deny access

based on user-agent (the browser type) you might do the

following:</p>

<example>

&lt;If "%{HTTP_USER_AGENT} = 'BadBot'"&gt;<br />

<indent>

Require All Denied<br />

</indent>

&lt;/If&gt;

</example>

<note><title>Warning:</title>

<p>Access control by <code>User-Agent</code> is an unreliable technique,

since the <code>User-Agent</code> header can be set to anything at all,

at the whim of the end user.</p>

</note>

<p>See <a href="/expr.html">the expressions document</a> for a

further discussion of what expression syntaxes and variables are

available to you.</p>

</section>

<section id="rewrite"><title>Access control with mod_rewrite</title>

<p>The <code>[F]</code> <directive

module="mod_rewrite">RewriteRule</directive> flag causes a 403 Forbidden

response to be sent. Using this, you can deny access to a resource based

on arbitrary criteria.</p>

<p>For example, if you wish to block access to a resource between 8pm

and 6am, you can do this using <module>mod_rewrite</module>.</p>

<example>

RewriteEngine On<br />

RewriteCond %{TIME_HOUR} &gt;20 [OR]<br />

RewriteCond %{TIME_HOUR} &lt;07<br />

RewriteRule ^/fridge - [F]

</example>

<p>This will return a 403 Forbidden response for any request after 8pm

or before 7am. This technique can be used for any criteria that you wish

to check. You can also redirect, or otherwise rewrite these requests, if

that approach is preferred.</p>

<p>The <directive type="section" module="core">If</directive> directive,

added in 2.4, replaces many things that <module>mod_rewrite</module> has

traditionally been used to do, and you should probably look there first

before resorting to mod_rewrite.</p>

</section>

<section id="moreinformation"><title>More information</title>

<p>The <a href="/expr.html">expression engine</a> gives you a

great deal of power to do a variety of things based on arbitrary

server variables, and you should consult that document for more

detail.</p>

<p>Also, you should read the <module>mod_authz_core</module>

documentation for examples of combining multiple access requirements

and specifying how they interact.</p>

<p>See also the <a href="auth.html">Authentication and Authorization</a>

howto.</p>

</section>

</manualpage>