Question: I need to prevent access to all files in a dir but one specific file, with a specific query string. I've been trying this so far, but I REQUEST\_URI doesn't have the QUERY STRING

```
SetEnvIf Request_URI ^index.php?myquery$ noauth=1
AuthType Basic
AuthUserFile /home/user/.htpasswd
AuthName "Pass"

Order Deny,Allow
Satisfy any
Deny from all
Require valid-user
Allow from env=noauth

```

Again, the user should only be able to access index.php?myquery. Not index.php or anything.php?myquery

Answer: 
SetEnvIf cannot access the query string in Apache 2.2. In 2.4, you could access the query string in a 2nd SetEnvIf or just use <if>

Here's a simple example in mod\_rewrite though that works in 2.2 vhost context:

```
RewriteEngine ON
RewriteCond %{REQUEST_URI} =/index.php
RewriteCond %{QUERY_STRING} =myquery
RewriteRule .* - [E=noauth:1]

```

Note: doesn't work in htaccess/per-dir context
Don't think you can do what you want here since you can't use mod\_rewrite to alter the request (auth module happens before rewrite module) and you can't match against the query string in the request URI. You may need to do something with some redirect trickery, maybe something like:

1. make a symlink of `index.php` called `index2.php` (so that they are the same file)
2. make the `SetEnvIf` call match simply `^/index.php`
3. *Within* the `index.php` script (probably near the very top), have it look for whether or not there's a `myquery` query string, and if not, redirect the request to `/index2.php`
4. When the browser is told to go to `/index2.php` instead, it gets asked for authentication
5. If the browser enters the correct auth, `index.php` gets executed (because of step #1).