Apache 2.4: AuthType Basic and REQUEST_URI - Comparisons (with or without regular expr.) do not work properly

Question

We use Apache 2.4.10 on a Debian Server. Requests are redirected from an Apache Proxy Server (same system and version) who acts as balancer (only the one balance member at the moment).

The access to the related single virtual host is generally restricted via AuthType Basic. Just one folder containing public documents should be accessable without authentication.

I tested multiple ways (new apache 2.4 syntax) to accomplish that - but no matter, which method i tried, i always stucked at the same issue: any comparison with the REQUEST_URI does not work as expected - with or without a regular expression. It seems as if the REQUEST_URI had an invalid value at the time when a comparison takes place.

I tried i.a. the following alternatives:

A)

<VirtualHost *:80>

ServerName domain.name
DocumentRoot /var/www/domain.name
DirectoryIndex index.php

<Directory "/var/www/domain.name/">

    AuthType Basic
    AuthName "Restricted"
    AuthBasicProvider file
    AuthUserFile /path/to/user/file

    <RequireAny>
        Require method OPTIONS
        Require expr %{REQUEST_URI} =~ m#^/docs#
        Require valid-user
    </RequireAny>

    Options +ExecCGI +FollowSymLinks
    AllowOverride All

</Directory>

CustomLog "/var/log/apache2/test_log" "%t REQUEST_URI:%{REQUEST_URI}e"

</VirtualHost>

B)

<VirtualHost *:80>

ServerName domain.name
DocumentRoot /var/www/domain.name
DirectoryIndex index.php

<Directory "/var/www/domain.name/">

    AuthType Basic
    AuthName "Restricted"
    AuthBasicProvider file
    AuthUserFile /path/to/user/file

    <RequireAny>
        Require method OPTIONS
        Require valid-user
    </RequireAny>

    Options +ExecCGI +FollowSymLinks
    AllowOverride All

</Directory>

<LocationMatch "^/docs">
    AuthType None
    Require all granted
</LocationMatch>

CustomLog "/var/log/apache2/test_log" "%t REQUEST_URI:%{REQUEST_URI}e"

</VirtualHost>

C)

<VirtualHost *:80>

ServerName domain.name
DocumentRoot /var/www/domain.name
DirectoryIndex index.php

<Directory "/var/www/domain.name/">

    SetEnvIf Request_URI /docs noAuth=1

    AuthType Basic
    AuthName "Restricted Files"
    AuthBasicProvider file
    AuthUserFile /path/to/user/file

    <RequireAny>
        Require method OPTIONS
        Require env noauth
        Require valid-user
    </RequireAny>

    Options +ExecCGI +FollowSymLinks
    AllowOverride All

</Directory>

CustomLog "/var/log/apache2/test_log" "%t REQUEST_URI:%{REQUEST_URI}e"

</VirtualHost>

Every alternative seems to stuck at the same issue. The comparison with the REQUEST_URI failes or does not work properly.

An example: When i change line 16 in example A to

Require expr %{REQUEST_URI} =~ m#^/[a-z]#

(as a test) then it works (access granted without credentials).

When i change [a-z] to e.g. [d-i], it still works, but when i change [a-z] to e.g. [d-g], it does not work anymore and the user/pass dialogue appears.

The exact same behaviour appears, when i change the regular expression in the LocationMatch directive in example B accordingly.

Another hint:

Using <Location /docs> instead of <LocationMatch... (see example B) does also not work. But <Location /> works.

And:

The log-output is always identical:

When access is granted without credentials the value of the REQUEST_URI is the same as the path part of the requested URL (e.g. /docs).

But when the user/pass-dialogue appears, the value is a dash ("-") this seems to be default value that apache uses for empty or not available values.

And:

The problem does persist, even when i access the server directly (without the proxy) or when i use e.g. wget to make a request to localhost on the server.

Does anyone have an idea whats going on here!?...

Answer 1

I finally found a workaround by myself. I use version A) - but with the environment variable THE_REQUEST instead of REQUEST_URI. Fortunately it works!

The adjusted version of A) - for GET requests only:

<VirtualHost *:80>

ServerName domain.name
DocumentRoot /var/www/domain.name
DirectoryIndex index.php

<Directory "/var/www/domain.name/">

AuthType Basic
AuthName "Restricted"
AuthBasicProvider file
AuthUserFile /path/to/user/file

<RequireAny>
    Require method OPTIONS
    Require expr %{THE_REQUEST} =~ m#GET\s+\/docs\/[^\/]+\s+HTTP#
    Require valid-user
</RequireAny>

Options +ExecCGI +FollowSymLinks
AllowOverride All

</Directory>

</VirtualHost>