<title>Conditional Per-Request Settings</title>
<p>For additional flexibility, the directives provided by
- mod_setenvif allow environment variables to be set on a
- per-request basis, conditional on characteristics of particular
+ <module>mod_setenvif</module> allow environment variables to be set
+ on a per-request basis, conditional on characteristics of particular
requests. For example, a variable could be set only when a
specific browser (User-Agent) is making a request, or only when
a specific Referer [sic] header is found. Even more flexibility
- is available through the mod_rewrite's <directive
- module="mod_rewrite">RewriteRule</directive> which uses the
+ is available through the <module>mod_rewrite</module>'s <directive
+ module="mod_rewrite">RewriteRule</directive> which uses the
<code>[E=...]</code> option to set environment variables.</p>
</section>
<section id="unique-identifiers">
<title>Unique Identifiers</title>
- <p>Finally, mod_unique_id sets the environment variable
- <code>UNIQUE_ID</code> for each request to a value which is
+ <p>Finally, <module>mod_unique_id</module> sets the environment
+ variable <code>UNIQUE_ID</code> for each request to a value which is
guaranteed to be unique across "all" requests under very
specific conditions.</p>
not be a number. Characters which do not match this
restriction will be replaced by an underscore when passed to
CGI scripts and SSI pages.</li>
-
+
<li>The <directive module="mod_env">SetEnv</directive> directive runs
late during request processing meaning that directives such as
<directive module="mod_setenvif">SetEnvIf</directive> and <directive
<section id="ssi-pages">
<title>SSI Pages</title>
- <p>Server-parsed (SSI) documents processed by mod_include's
+ <p>Server-parsed (SSI) documents processed by
+ <module>mod_include</module>'s
<code>INCLUDES</code> filter can print environment variables
using the <code>echo</code> element, and can use environment
variables in flow control elements to makes parts of a page
<p>Access to the server can be controlled based on the value of
environment variables using the <code>allow from env=</code>
and <code>deny from env=</code> directives. In combination with
- <directive module="mod_setenvif">SetEnvIf</directive>, this
- allows for flexible control of access to the server based on
- characteristics of the client. For example, you can use these
+ <directive module="mod_setenvif">SetEnvIf</directive>, this
+ allows for flexible control of access to the server based on
+ characteristics of the client. For example, you can use these
directives to deny access to a particular browser (User-Agent).
</p>
<p>Environment variables can be logged in the access log using
the <directive module="mod_log_config">LogFormat</directive>
option <code>%e</code>. In addition, the decision on whether
- or not to log requests can be made based on the status of
- environment variables using the conditional form of the
+ or not to log requests can be made based on the status of
+ environment variables using the conditional form of the
<directive module="mod_log_config">CustomLog</directive>
directive. In combination with <directive module="mod_setenvif"
- >SetEnvIf</directive> this allows for flexible control of which
- requests are logged. For example, you can choose not to log
+ >SetEnvIf</directive> this allows for flexible control of which
+ requests are logged. For example, you can choose not to log
requests for filenames ending in <code>gif</code>, or you can
choose to only log requests from clients which are outside your
subnet.</p>
<section id="url-rewriting">
<title>URL Rewriting</title>
- <p>The <code>%{ENV:...}</code> form of <em>TestString</em> in
- the <directive module="mod_rewrite">RewriteCond</directive>
- allows mod_rewrite's rewrite
+ <p>The <code>%{ENV:<em>variable</em>}</code> form of
+ <em>TestString</em> in the <directive module="mod_rewrite"
+ >RewriteCond</directive> allows <module>mod_rewrite</module>'s rewrite
engine to make decisions conditional on environment variables.
- Note that the variables accessible in mod_rewrite without the
- <code>ENV:</code> prefix are not actually environment
- variables. Rather, they are variables special to mod_rewrite
- which cannot be accessed from other modules.</p>
+ Note that the variables accessible in <module>mod_rewrite</module>
+ without the <code>ENV:</code> prefix are not actually environment
+ variables. Rather, they are variables special to
+ <module>mod_rewrite</module> which cannot be accessed from other
+ modules.</p>
</section>
</section>
<section id="gzip-only-text-html">
<title>gzip-only-text/html</title>
- <p>When set to a value of "1", this variable disables the DEFLATE
- output filter provided by <module>mod_deflate</module> for
- content-types other than <code>text/html</code>. If you'd rather
+ <p>When set to a value of "1", this variable disables the
+ <code>DEFLATE</code> output filter provided by
+ <module>mod_deflate</module> for content-types other than
+ <code>text/html</code>. If you'd rather
use statically compressed files, <module>mod_negotiation</module>
evaluates the variable as well (not only for gzip, but for all
encodings that differ from "identity").</p>
to the client. This is typically used when a client has a known
problem handling redirects. This was originally implemented as a
result of a problem with Microsoft's WebFolders software which has
- a problem handling redirects on directory resources via DAV
+ a problem handling redirects on directory resources via DAV
methods.</p>
</section>
the client can't (or doesn't) automatically follow the redirection.
Apache ordinarily labels this text according to the character set
which it uses, which is ISO-8859-1.</p>
+
<p> However, if the redirection is to a page that uses a different
character set, some broken browser versions will try to use the
character set from the redirection text rather than the actual page.
This can result in Greek, for instance, being incorrectly rendered.</p>
+
<p>Setting this environment variable causes Apache to omit the character
set for the redirection text, and these broken browsers will then correctly
use that of the destination page.</p>
<note type="warning">
- <title>Security note</title>
+ <title>Security note</title>
<p>Sending error pages without a specified character set may
allow a cross-site-scripting attack for existing browsers (MSIE)
access log. It can be easily modified to prevent logging of
particular directories, or to prevent logging of requests
coming from particular hosts.</p>
- <example><pre>
-SetEnvIf Request_URI \.gif image-request
-SetEnvIf Request_URI \.jpg image-request
-SetEnvIf Request_URI \.png image-request
-CustomLog logs/access_log common env=!image-request</pre></example>
+
+ <example>
+ SetEnvIf Request_URI \.gif image-request<br />
+ SetEnvIf Request_URI \.jpg image-request<br />
+ SetEnvIf Request_URI \.png image-request<br />
+ CustomLog logs/access_log common env=!image-request
+ </example>
</section>
<section id="image-theft">
from using images on your server as inline-images on their
pages. This is not a recommended configuration, but it can work
in limited circumstances. We assume that all your images are in
- a directory called /web/images.</p>
- <example><pre>
-SetEnvIf Referer "^http://www\.example\.com/" local_referal
-# Allow browsers that do not send Referer info
-SetEnvIf Referer "^$" local_referal
-<Directory /web/images>
- Order Deny,Allow
- Deny from all
- Allow from env=local_referal
-</Directory></pre></example>
+ a directory called <code>/web/images</code>.</p>
+
+ <example>
+ SetEnvIf Referer "^http://www\.example\.com/" local_referal
+ # Allow browsers that do not send Referer info
+ SetEnvIf Referer "^$" local_referal
+ <Directory /web/images>
+ <indent>
+ Order Deny,Allow<br />
+ Deny from all<br />
+ Allow from env=local_referal
+ </indent>
+ </Directory>
+ </example>
<p>For more information about this technique, see the
"<a href="http://www.serverwatch.com/tutorials/article.php/1132731"
projects / apache / commitdiff