12

I would like somebody to help me with an if-else statement in htaccess. What I want is htaccess to read a cookie and check if its value equals a defined value. If it evaluates to false, it should excecute a redirect and prevent from the requested folder to be accessed. Maybe a deny from all would be better if the evaluation returns false.

I know that the following code checks if a named cookie value is set. If it is not set, it will execute the rewrite rule below it. But how can I adjust this line so that it checks if it equals a certain value?

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !^.*cookie_name.*$ [NC]
RewriteRule .* http://www.google.com [NC,L]

What I would like, but in .htaccess style:

if ($_COOKIE['cookie_name'] != 'specific_value'){
//rewrite_rule or deny from all.
}
2

4 Answers 4

19

You're close. The cookie string needs a =:

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !cookie_name=specific_value; [NC]
RewriteRule ^ http://www.google.com [NC,L]
2
  • 3
    For single or multiple cookies there should be pattern ;? If there is single Cookie present on site, the pattern will not work. Updated solution does the job: RewriteEngine On RewriteCond %{HTTP_COOKIE} !cookie_name=specific_value;? [NC] RewriteRule ^ http://www.google.com [NC,L] May 27, 2018 at 8:03
  • @Kusak and that equals to just !cookie_name=specific_value
    – darkdiatel
    May 25 at 10:02
8

Replace required_value with the value that needs to be matched.

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !cookie_name=required_value;? [NC]
RewriteRule ^ http://www.google.com [R=301,L]

;? makes sure that the match happens both when there are multiple cookie value pairs or when cookie_name is the only cookie set. This also prevents from matching on a cookie value like off when a match on only of (a substring) is required.

1
  • Yes, for single or multiple cookies there should be pattern ;? May 27, 2018 at 8:02
1

You can use this code that checks for specific value in the cookie:

RewriteEngine On

RewriteCond %{HTTP_COOKIE} !cookie_name=specific_value [NC]
RewriteRule ^ http://www.google.com [NC,L,R=302]
0

The %{HTTP_COOKIE} string looks like a series of escaped name-value pairs separated by semicolons, and each semicolon is followed by a space. From MDN:

Syntax

Cookie: <cookie-list>
Cookie: name=value
Cookie: name=value; name2=value2; name3=value3

<cookie-list>

  • A list of name-value pairs in the form of =. Pairs in the list are separated by a semicolon and a space ('; ').

Examples

Cookie: PHPSESSID=298zf09hf012fh2; csrftoken=u32t4o3tb3gg43; _gat=1

So in your regular expression, you need to optionally match the semicolon followed by a space at the beginning and the semicolon at the end like so:

RewriteCond %{HTTP_COOKIE} "!(?:^|; )cookie_name=specific_value(?:;|$)"

Note: Different set-cookie functions escape different characters. So while one function might escape the @ symbol, another one might not causing inconsistencies in how your cookie string looks. For example a search for [email protected] might fail if it is stored as useremail%40gmail.com. They are both valid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.