Oracle B12255-01 Manuale Utente

Authentication and Authorization Enforcement

Oracle HTTP Server Administrator’s Guide

You can use arbitrary environment

variables for access control, instead of using IP addresses or domain names. Use
BrowserMatch

 and SetEnvIf directives for this type of access control.

Use BrowserMatch when you want to base access on the type of browser used to
send a request. For instance, if you want to allow access only to requests that come
from a Netscape browser, then use the syntax shown in

:

BrowserMatch ^Mozilla netscape_browser

<Directory /mozilla-area/>

  order deny,allow

  deny from all

  allow from env=netscape_browser

</Directory>

Use SetEnvIf when you want to base access on header information contained in
the HTTP request. For instance, if you want to deny access from any browsers using
HTTP version 1.0 or earlier, then use the syntax shown in

:

SetEnvIf Request_Protocol ^HTTP/1.1 http_11_ok

<Directory /http1.1only/>

  order deny,allow

  deny from all

  allow from env=http_11_ok

</Directory>

Typically, BrowserMatch and SetEnvIf are not used to

implement security policies. Instead they are used to provide
different handling of requests based on browser types and versions.