Laravel路由与多.htaccess配置：指定路由专属IP访问控制规则

Got it, let's break down how to set up .htaccess rules for your Laravel app to meet your requirements: allowing all IPs to access the homepage, while restricting specific routes (like payment endpoints) to a whitelist of IPs.

Prerequisites #

First, make sure your Apache server has these modules enabled:

• mod_rewrite (required for Laravel's URL rewriting)
• mod_authz_core (or mod_authz_host for older Apache versions) — needed for IP-based access control

You can verify enabled modules with apache2ctl -M on Linux, or check your Apache config file on Windows.

Step 1: Modify the Public .htaccess File #

Laravel's main entry point is the public/index.php file, so we'll edit the .htaccess in the public directory. Add the IP restriction rules before the existing Laravel rewrite rules to ensure access checks happen first.

Here's the complete, ready-to-use .htaccess example:

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    # --------------------------
    # IP Access Control Rules
    # --------------------------
    # Mark homepage routes as allowed for all IPs
    SetEnvIf Request_URI "^/$" allow_all
    SetEnvIf Request_URI "^/index.php$" allow_all

    # Mark restricted routes (update these to match your actual routes)
    SetEnvIf Request_URI "^/payment" restricted_route
    SetEnvIf Request_URI "^/checkout" restricted_route
    SetEnvIf Request_URI "^/admin/manage-payments" restricted_route

    # Whitelisted IPs (replace with your actual allowed IPs, separate with spaces)
    Allow from 192.168.1.100 10.0.0.5 172.16.3.0/24

    # Deny all access by default
    Deny from all

    # Allow all IPs to access homepage, allow whitelisted IPs to access restricted routes
    Allow from env=allow_all
    Allow from env=restricted_route
    # --------------------------
    # End IP Control Rules
    # --------------------------

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

How It Works #

Let's break down the key parts:

• Homepage Access: SetEnvIf Request_URI "^/$" allow_all marks the root path (your homepage) as accessible to everyone. We also include /index.php to cover direct access to the entry file.
• Restricted Routes: SetEnvIf Request_URI "^/payment" restricted_route tags any request starting with /payment (and your other specified routes) as restricted. Adjust the regex to match your actual route patterns (e.g., use ^/payment/ if you need to match subpaths like /payment/123).
• IP Whitelist: Allow from 192.168.1.100 10.0.0.5 172.16.3.0/24 lists the IPs allowed to access restricted routes. You can use full IPs or CIDR notation for IP ranges.
• Access Logic: We start with Deny from all to block everything by default, then explicitly allow access to the homepage (for all IPs) and restricted routes (only for whitelisted IPs).

Important Notes #

• Dynamic Routes: If your restricted routes have dynamic parameters (like /payment/{order_id}), use a regex like ^/payment to match all requests starting with that path.
• Testing: After setting up, test with:
  • A non-whitelisted IP: You should get a 403 Forbidden error when accessing restricted routes, but the homepage loads fine.
  • A whitelisted IP: All routes should load normally.
• Alternative: If you prefer a Laravel-native solution instead of .htaccess, you could create a custom middleware to handle IP restrictions — but since you asked for .htaccess, this is the direct approach.

内容的提问来源于stack exchange，提问作者reza sadeghi