Oracle HTTP Server, Руководство администратора

Страница: 138 / 224

Authentication and Authorization Enforcement
8-8 Oracle HTTP Server Administrator’s Guide
Controlling Access with Environment Variables You can use arbitrary environment
variables for access control, instead of using IP addresses or domain names. Use
BrowserMatch
and
SetEnvIf
directives for this type of access control.
Use
BrowserMatch
when you want to base access on the type of browser used to
send a request. For instance, if you want to allow access only to requests that come
from a Netscape browser, then use the syntax shown in
Example 8–6 :
Example 8–6 Controlling Access with Environment Variables
BrowserMatch ^Mozilla netscape_browser
<Directory /mozilla-area/>
order deny,allow
deny from all
allow from env=netscape_browser
</Directory>
Use
SetEnvIf
when you want to base access on header information contained in
the HTTP request. For instance, if you want to deny access from any browsers using
HTTP version 1.0 or earlier, then use the syntax shown in
Example 8–7 :
Example 8–7 Controlling Access with SetEnv
SetEnvIf Request_Protocol ^HTTP/1.1 http_11_ok
<Directory /http1.1only/>
order deny,allow
deny from all
allow from env=http_11_ok
</Directory>
Note: Typically,
BrowserMatch
and
SetEnvIf
are not used to
implement security policies. Instead they are used to provide
different handling of requests based on browser types and versions.
See Also:
"Scope of Directives" on page 2-4