Is it possible to path protect by header values in apache?

Question

Is there a mod / way to get this pseudo code working in apache?

<Location /somepath/>
   if not value of request header 'x-token' is 'secret' deny
</Location>

Answer 1

It's definitely possible, but probably not a great idea for robust security, since anyone could spoof it.

Use the SetEnvIf directive to set a variable based on the header:

http://httpd.apache.org/docs/2.2/mod/mod_setenvif.html

Then use that to lock down your location:

<Location /somepath/>
  Allow from env=your_variable
</Location>