Question: I need to prevent access to all files in a dir but one specific file, with a specific query string. I've been trying this so far, but I REQUEST\_URI doesn't have the QUERY STRING

```
SetEnvIf Request_URI ^index.php?myquery$ noauth=1
AuthType Basic
AuthUserFile /home/user/.htpasswd
AuthName "Pass"

Order Deny,Allow
Satisfy any
Deny from all
Require valid-user
Allow from env=noauth

```

Again, the user should only be able to access index.php?myquery. Not index.php or anything.php?myquery

Answer: 
SetEnvIf cannot access the query string in Apache 2.2. In 2.4, you could access the query string in a 2nd SetEnvIf or just use <if>

Here's a simple example in mod\_rewrite though that works in 2.2 vhost context:

```
RewriteEngine ON
RewriteCond %{REQUEST_URI} =/index.php
RewriteCond %{QUERY_STRING} =myquery
RewriteRule .* - [E=noauth:1]

```

Note: doesn't work in htaccess/per-dir context
If you are using Apache 2.4, SetEnvIf and mod\_rewrite workarounds are no longer necessary since the Require directive is able to interpret [expressions](https://httpd.apache.org/docs/2.4/expr.html) directly:

Apache 2.4 treats Require directives that are not grouped by as if they were in a , which behaves as an "or" statement. 

Allow access to /callbacks/foo

```
Require expr %{REQUEST_URI} =~ m#^/callbacks/.*#
Require valid-user

```

Allow access to /callbacks/foo?secret\_var=42 :

```
Require expr %{QUERY_STRING} = 'secret_var=42'
Require valid-user

```

This example would allow access to /callbacks/foo?secret\_var=42 but require a username and password for /callbacks/foo :

```
<RequireAny>
    <RequireAll>
        # I'm using the alternate matching form here so I don't have
        # to escape the /'s in the URL.
        Require expr %{REQUEST_URI} =~ m#^/callbacks/.*#
        Require expr %{QUERY_STRING} = 'secret_var=42'
    </RequireAll>

    Require valid-user
</RequireAny>

```

[More examples.](https://ffff65535.com/en/q/88fea0)