.htaccess rejecting iOS connections when passing required X-Requested-With

I want to use X-Requested-With in the headers when calling my server API. The server has an .htaccess line to look for a specific value in the X-Requested-With field, ie: X-Requested-with: com.myApp - if not found, reject the connection. Yes, I know X-Requested-With can be spoofed and is not a secure method to rely on, but it is a first line of defense in my app/server security.

The below htaccess condition is working for Android devices, but for iOS devices the connection is being rejected. In iOS, I can see X-Requested-With being passed, with the correct value, so why would the server reject the connection ONLY with for iOS? And how can I resolve this on iOS?

.htaccess:

RewriteCond %{HTTP:X-Requested-With} !^com.myapp$ [NC]
RewriteRule ^ - [F]

I have tried multiple conditions, and they all fail:

RewriteCond %{HTTP:X-Requested-With} !^com.myapp [NC]
RewriteCond %{HTTP:X-Requested-With} !com.myapp [NC]
RewriteCond %{HTTP:X-Requested-With} !com\.myapp [NC]
RewriteCond %{HTTP:X-Requested-With} !myapp [NC]

My server connections are all HTTPS, but the above rule was working (using just HTTP) for Android. If I change it to HTTPS it breaks connections for Android too. Which I find odd since all the connections are HTTPS. Why is this?

In the iOS Request headers (all versions), I also see: Origin: ionic//myapp, but on Android its just Origin: http://localhost, how can I get Android to also show Origin: ionic//myapp or similar? If I could get Android to show the same as iOS then maybe my htaccess could look for Origin instead of X-Requested-With?

And last, is it possible to write a conditional htaccess rule; one for Android using X-Requested-With and one for iOS Origin, how can I do that? ie:

RewriteCond %{HTTP:X-Requested-With} !^com.myapp$ OR %{HTTP:Origin} !^ionic//myapp$ [NC]
RewriteCond ^ - [F]

> In iOS, I can see X-Requested-With being passed, with the correct value, so why would the server reject the connection ONLY with for iOS?
>
> RewriteCond %{HTTP:X-Requested-With} !^com.myapp$ [NC]
> RewriteRule ^ - [F]

The only reason why this would fail (and the request is blocked) is if the request that your server receives does not contain the header as expected.

So that would seem to imply that the request received from the iOS device does not contain the expected header. Maybe the app is sending the header but an intermediary proxy is removing/modifying it before it reaches your server?

You should be able to determine what headers your application is actually receiving on the HTTP request.

> RewriteCond %{HTTP:X-Requested-With} !myapp [NC]
>
> My server connections are all HTTPS, but the above rule was working (using just HTTP) for Android. If I change it to HTTPS it breaks connections for Android too. Which I find odd since all the connections are HTTPS. Why is this?

The %{HTTP:<header>} syntax refers to the HTTP request header by that name. This is regardless of whether the request is over HTTP or HTTPS. HTTPS is simply HTTP over SSL/TLS. It's still an "HTTP header". There is no such thing as %{HTTPS:<header>} - if this doesn't result in an error then it will simply return an empty string and your negated condition will be successful (thus blocking the request).

> In the iOS Request headers (all versions), I also see: Origin: ionic//myapp, but on Android its just Origin: http://localhost, how can I get Android to also show Origin: ionic//myapp or similar? If I could get Android to show the same as iOS then maybe my htaccess could look for Origin instead of X-Requested-With?

You have no control over the setting of the Origin header, this is determined by the User-Agent (browser, app engine, etc.)

But you can presumably check for (not) either. For example:

RewriteCond %{HTTP:Origin} !^(http://localhost|ionic//myapp)$ [NC]

Or, splitting into two conditions:

RewriteCond %{HTTP:Origin} !=http://localhost
RewriteCond %{HTTP:Origin} !=ionic//myapp

This second example uses the = prefix operator to make it an exact string match (lexicographical comparison), as opposed to a regex.

> RewriteCond %{HTTP:X-Requested-With} !^com.myapp$ OR %{HTTP:Origin} !^ionic//myapp$ [NC]
> RewriteCond ^ - [F]

You can use the OR flag on the RewriteCond directive. However, the logic should be AND , not OR, when dealing with negated conditons. If you perform a logical OR on two negated conditions then the condition will always be successful and the request will always be blocked.

For example, it should be something like:

RewriteCond %{HTTP:X-Requested-With} !^com\.myapp$ [NC]
RewriteCond %{HTTP:Origin} !^ionic//myapp$ [NC]
RewriteRule ^ - [F]

The two conditions are implicitly AND'd.