Redirect non-logged in users using htaccess

With apache mod-rewrite it is quite possible to manipulate http cookies. The cookie you set using php or RewriteRule can easily be accessed using RewriteCond directive.
If you need to redirect your non-logged in users of your website to a diffrent page using RewriteRule you need to check the COOKIES in RewriteCond directive .
You can use %{HTTP_COOKIE} variable which is a pre defined mod-rewrite variable to check if the user visiting your site has cookies set.
Assuming the following user cookie is set user=loggedin
You can simply use a RewriteRule to redirect your non-logged in users to a diffrent page based on if the cookie exists.

The rewrite rule above will redirect user to /page2.php if the cookie user=loggedin doesnt exist or isnt set. The rule also redirects files like css , js and other website resources. You can simply add other conditions to exclude your existent files so that it can only redirect the user request. The following rule should work in that case :

Many users who use htaccess often get confused by mod-rewrite %{THE_REQUEST} variable. The questions what is it and how do we use it appear on their mind. In this post I will explain what %{THE_REQUEST} actually is and how we can use it in rewriteRule.

What is %{THE_REQUEST} in mod rewrite?

%{THE_REQUEST} is a mod rewrite per defined variable like other variable ie %{HTTP_HOST} . To understand what URI string the_request variable actually contains you can write a rule to print it.
THE_REQUEST variable contains the full URI string including Request method and Server protocol. The following is the example of THE_REQUEST string . When you type /file.php in your browser , your browser sends the following request to server:

• GET is the request method
• /file.php is the file you requested.
• HTTP/1.1 is the protocol version of your apache server.

We use %{THE_REQUEST} in RewriteCond to conditionally rewrite urls and avoid infinite loop error as this variable works as an anti loop protection for rewriteRules.

In the example above we match against %{THE_REQUEST} using regex. If the regex pattern matches then the rule is triggered. The rule will redirect /file.php to /file. You can also use a simple regex pattern that only matches the file name

THE_REQUEST variable is often used with rules that remove file extensions. When two rules (Rule with R flag and Rule with L) rewrite the same file name THE_THE_REQUEST should be used at the top of External rewrite rule (Rule with R flag) to avoid the loop error.

URL rewriting and URL redirection are two different terms used to map a URL from one location to the other. These two terms often confuse new users especially when they refer to URL related queries. Some users even intermix the URL rewriting logic with URL redirection like they are talking about a particular thing with two different languages. I often see such questions on StackOverflow and encourage posters to fix it.

In this post I will give you a clear overview of what these two terms actually mean and how we use them with URLs.

URL redirection

URL redirection is when an URL redirects from one location to the other and the appriance of URL changes in browser address bar from old to new (from the typed URL to the new location). URL redirction happens client side . Server gives a command to your web browser to change the URL to a new location. Lets understand with a real world example : if you click on this link my server will send a redirect command to your browser to go from this page to example.com.

Notice how the URL changes in your browser address bar to example.com. This redirection is also called external redirection or transpirant redirection as its visible to your web browser and your browser knows whats happening on the screen. On apache server you can create a Redirect either by using a file based method in html, PHP or using Redirect commands in htaccess or server.config file. Apache server provides multiple methods to redirect URLs by htaccess. There are 2 diffrent modules that you can use for URL redirection on apache Mod-alias and mod-rewrite both modules support htaccess and server.config context.

4 ways to redirect URLs on apache server

Given bellow are the common methods to redirect URLs from a website.

1. HTML:
   HTML anchor tag (a) is used to redirect the currunt page URL to a specific location
   <a href=”http://example.com”&#62redirect to example.com”</a>

2. PHP:
   Redirecting the current page to example.com
   <?php
   header(“location:https://example.com/”);
   ?>

3. Redirecting a specific path to example.com using Redirect directive in htaccess:
   Redirect /path http://example.com/

4. Redirecting a specific path to example.com using RewriteRule in htaccess:
   RewriteEngine on
   RewriteRule ^thispath http://example.com [R]

URL rewriting

URL rewriting is way of rewriting urls. URL rewriting is When a URL path internally maps to another path on server. By “internally” I mean an “Invisible URL redirection” . You and your browser can’t see how the url changes from Old to new as it starts and ends behind the screen and your browser stays on the same URL. URL rewriting is server side only as it happens on a webserver without informing the client of the redirection. You get the web page from new location on the same (typed) url as it doesn’t change from old to the new one.
URL rewriting is also called internal URL or invisible url redirection as its invisible to a web browser only the webserver executes this redirection and sends the contents of the new page to browser. For example the following url http://example.com/file can be rewritten to http://example.com/file.php by using a RewriteRule directive on apache server. And then instead of typing /file.php you can simply type the new url /file your server will internally redirect/rewrite it to /file.php serving you the contents of /file.php on the /file URI.

Rewriting URLs on apache server

Apache server provides mod-rewrite module for rewriting URLs. In order to use this module you must first enable it on your server if it isnt already enabled.
There are hundreds of URLs rewriting basic examples on Apache guide if you are new you can read their complete guide to understand how it works . To rewrite URLs on apache server, you can either use your config file or your htaccess to write rules.
URL rewriting is done by using RewriteRule directive of mod-rewrite module. The following is a basic example of how we use RewriteRule in an htaccess file. The rule rewrites /a.php to /b.php .

In this post I will show you how we can set an http cookie using a RewriteRule directive in an htaccess or server.config file.
I saw many unanswered and some wrong answered posts on StackOverflow and on other sites so I thought It would be worth writing a post here that can help peope looking for help regarding Htaccess and mod_rewrite cookies.

Setting cookies using mod_rewrite

With RewriteRule directive you can set http cookies the same way you use the directive for rewriting URLs. Cookies are set using [CO] Cookie flag of apache mod-rewrite. The cookies you set via RewriteRule can also be accessed by client or server scripting languages like PHP and JS.

Mod rewrite cookies are mainy used for rewriting requests based on http cookie header.
You often set a mod rewrite cookie to rewrite/direct URLs if a specific cookie exists or based on cookie value .

Let’s start with a basic example first:

RewriteEngine On
RewriteRule (.*) - [CO=user:john]

The rewrite rule above will set cookie named user and as you can see we manually assigned value john to it.
Explanation :

• The first line “RewriteEngine on” tells server to turn on the engine for rewriting URLs. This setting is disabled by default so you must use this line ones at the top of RewriteRules in htaccess or server.config files.
• The second line is that does the Rewrite mazic and sets the cookie whenever you request an URI from server.
  “RewriteRule (.*) – [CO=user:john]” matches any incoming URIs as the pattern (.*) means to match anything. The – hyphen in the Rule’s destination above lets the URI pass through unchanged meaning that if the request is for /file.php only the CO flag will be applied to the URL and there will not be any change in the URL. In most cases when setting cookies by RewriteRule you use – as the destination path because we don’t want to rewrite the urls we just want to set a cookie for URLs.
  “[CO=user:john]” sets user cookie with value john. You can also use a dynamic value using regex match “$1” or “%1” .

Setting cookies for specific URIs with mod_rewrite

In the basic example above we learned how to set cookies when any URL passes through RewriteRule. You can also set cookies for a specific URI. For example to set cookies only for a single path or file ie /this-file.php you can restrict the pattern of RewriteRule to match only this URI. You just need to write a regular expression pattern to match that particular path.

RewriteEngine On
RewriteRule ^this-file.php$ - [CO=user:john]

This will set the cookie only when you request /this-file.php . This rule example might fail on server.config, add a leading slash in the pattern ie: ^/this-file.php$ to use this in a server.config file.

Checking cookies using mod-rewrite

We use RewriteCond directive to check whether a cookie is set or notset and to test the value of a cookie that is already set. We can also check what value the cookie holds. The following is a basic example of checking whether a cookie is set :

RewriteCond %{HTTP_COOKIE} !^$

In the example above we want to make sure our cookie is set or not empty (!^$) . You can use a RewriteRule bellow this condition so it executes if the condition is met.

In the example bellow, we will redirect /this-file.php to root / if our user cookie is not set.

RewriteEngine on
RewriteCond %{HTTP_COOKIE} !user
RewriteRule ^this-file.php$ / [R,L]

Another mod_rewrite cookie example

RewriteEngine on
RewriteCond %{HTTP_COOKIE} ^user=john
RewriteRule ^this-file.php$ / [R,L]

The rule above will redirect /this-file.php to / if the cookie user and value john is set.

Setting cookie user if it doesn’t already exist

You can set a specific cookies if it doesn’t exist using the following RewriteRule:

RewriteEngine on
RewriteCond %{HTTP_COOKIE} !^user=john
RewriteRule .* - [CO=user:john,L]

In the example above we first check the HTTP_COOKIE header to ensure that the cookie “user=john” is notset and then we set it via RewriteRule.

Setting cookies for a specific domain

By default, mod-rewrite cookies are set for all domains that point to the same document root. You can add an optional perameter domain to the CO flag. To set cookies only for a specific host ie:www.example.com you will use something like the following:

RewriteEngine on
RewriteCond %{HTTP_COOKIE} !^user=john
RewriteRule ^this-file.php$ - [CO=user:john:www.example.com,L]

Setting cookies Lifetime with htaccess

By default mod-rewrite cookies are set for current session only which means when the browser window is closed the cookies also get destroyed. You can add a lifetime perameter in minutes to CO flag to customise cookies validity.

RewriteEngine on
RewriteRule ^this-file.php$ - [CO=user:john:www.example.com:10,L]

In the example above the user cookie is available only on www.example.com host and it expires after 10 minutes.

Cookies for specific path only

You can make the cookies available for a specific path only. By default mod-rewrite cookies are set for / which means the entire site. To set a specific path you may use :

RewriteEngine on
RewriteRule ^this-file.php$ - [CO=user:john:www.example.com,L]

Setting cookies expire time

You can set how long an http cookie will survive, by default mod-rewrite cookies are set for current browser session only and deleted when we close the browser window. You can add a time perameter to CO flag to extend the cookie validity . Time value is set in minutes.

RewriteEngine on
RewriteRule ^this-file.php$ - [CO=user:john:www.example.com:10,L]

This will set user cookie on www.example.com host with a validity of 10 minutes.