# extend default virtual host. put/include these rewrite rules in https or
# any other virtual host if you want to enable cookie authentication

# redirect /thruk -> /thruk/ to avoid problems with cookies
RewriteRule ^@HTMLURL@$              @HTMLURL@/ [R=302,L]

# cookie based authentication
RewriteEngine On
RewriteMap  thruk_users              prg:@DATADIR@/thruk_auth
RewriteCond %{REQUEST_URI}           !^@HTMLURL@/cgi-bin/restricted.cgi
RewriteCond %{REQUEST_URI}           ^@HTMLURL@
RewriteCond %{HTTP_COOKIE}           (thruk_auth=[^;]+|$)  [NC]
RewriteRule ^/(.*)$                  /auth:%1/%{REMOTE_ADDR}~~%{HTTP:Authorization}~~%{HTTP:X-Thruk-Auth-Key}~~%{HTTP:X-Thruk-Auth-User}/____/$1/____/%{QUERY_STRING} [C,NS@UNSAFEALLOW3F@]
RewriteRule ^(.*)$                   ${thruk_users:$1|/loginbad/} [C,NS@UNSAFEALLOW3F@]
RewriteRule ^/pass/(.*)$             /$1 [NS,PT,L,E=!REMOTE_USER@UNSAFEALLOW3F@]
RewriteRule ^/redirect/(.*)$         /$1 [NS,L,R=302@UNSAFEALLOW3F@]
RewriteRule ^/loginok/([^/]+)/(.*)$  /$2 [NS,PT,L,E=REMOTE_USER:$1@UNSAFEALLOW3F@]

# finally exclude everything from basic auth, except the restricted.cgi
<LocationMatch ^@HTMLURL@(?!/cgi-bin/restricted.cgi)>
    Require all granted
</LocationMatch>

AllowEncodedSlashes NoDecode
