Intermittent 403 errors when using allow to limit access to url with both explicit IP and SetEnvIf
- by rbieber
We are running Apache 2.2.22 on a Solaris 10 environment.
We have a specific URL that we want to limit access to by IP. We recently implemented a CDN and now have the added complexity that the IP's that a request are shown to be coming from are actually the CDN servers and not the ultimate end user. In the case that we need to back the CDN out, we want to handle the case where either the CDN is forwarding the request, or the ultimate client is sending the request directly.
The CDN sends the end user IP address in an HTTP header (for this scenario that header is called "User-IP"). Here is the configuration that we have put in place:
SetEnvIf User-IP (\d+\.\d+\.\d+\.\d+) REAL_USER_IP=$1
SetEnvIf REAL_USER_IP "(10\.1\.2\.3|192\.168\..+)" access_allowed=1
<Location /uri/>
Order deny,allow
Allow from 10.1.2.3 192.168.
allow from env=access_allowed
Deny from all
</Location>
This seems to work fine for a time, however at some point the web server starts serving 403 errors to the end user - so for some reason it is restricting access. The odd thing is that a bounce of the web server seems to resolve the issue, but only for a time - then the behavior comes back.
It might be worthwhile to note as well that this URL is delegated to a JBoss server via mod_jk. The denial of access is, however; confirmed to be at the Apache layer and the issue only seems to happen after the server has been running for some time.
