# ACL doesn't work with multiple condition (beg\_path AND

**URL:** https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430
**Category:** Help!
**Created:** [July 3, 2020, 1:09pm UTC](https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430 "2020-07-03T13:09:10Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![parwin.bajwa](https://avatars.discourse-cdn.com/v4/letter/p/ecae2f/32.png) [@parwin.bajwa](https://discourse.haproxy.org/u/parwin.bajwa)
#### Post date: [July 3, 2020, 1:09pm UTC](https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430/1 "2020-07-03T13:09:11Z")

</div>

I have issue with my haproxy that running on my Ubuntu 16.04, i want to set static token to both environment on my server.

I am using path\_beg and ssl\_fc\_sni

this is my config

```auto
frontend https
bind *:443 ssl crt /etc/ssl/mykey.pem

acl url_staging path_beg /123456
use_backend staging if { ssl_fc_sni staging.com AND url_staging }

acl url_production path_beg /789012
use_backend production if { ssl_fc_sni production.com AND url_production }

default_backend no-match

backend staging
    http-request set-path "%[path,regsub(^/123456/,/)]" # to remove the token after authenticated.
    server staging 127.0.0.1:4723

backend production
    http-request set-path "%[path,regsub(^/789012/,/)]" # to remove the token after authenticated.
    server production 127.0.0.1:4723

backend no-match  
    http-request deny deny_status 403

```

the problem is, when i try to visit production with staging token, it works and authenticated. [production.com/123456](http://production.com/123456) it will work, and vice versa.

`acl staging hdr(Host) staging.com && path /123456 `

I did tried as per above, put both condition in the same ACL with AND expression but it getting worst, it was able to access without token.

What i want is, to authenticate staging with token/path staging which is 123456, and when i visit production must use production token/path. It should refuse when i hit endpoint production with token staging

so it will refuse connection when i try with [production.com/123456](http://production.com/123456).

_ **HA-Proxy version 1.8.25-1** _

Thanks

---

<div class="post-metadata">

### Author: ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [July 3, 2020, 2:32pm UTC](https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430/2 "2020-07-03T14:32:10Z")

</div>

Wrong statement, you need to close your anonymous ACL with }, instead you have that at the end.

Use:

```
acl url_staging path_beg /123456
use_backend staging if { ssl_fc_sni staging.com } AND url_staging

acl url_production path_beg /789012
use_backend production if { ssl_fc_sni production.com } AND url_production

```

And since AND is implicit, you can just:

```
acl url_staging path_beg /123456
use_backend staging if { ssl_fc_sni staging.com } url_staging

acl url_production path_beg /789012
use_backend production if { ssl_fc_sni production.com } url_production
```

---

<div class="post-metadata">

### Author: ![parwin.bajwa](https://avatars.discourse-cdn.com/v4/letter/p/ecae2f/32.png) [@parwin.bajwa](https://discourse.haproxy.org/u/parwin.bajwa)
#### Post date: [July 4, 2020, 1:07pm UTC](https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430/3 "2020-07-04T13:07:12Z")

</div>

Thanks. It works.

Anyway just want to check something with you.

You have mentioned that , AND is implicit, means that AND is default for multiple condition in HAproxy, or you referring to something else ?

---

<div class="post-metadata">

### Author: ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [July 4, 2020, 1:41pm UTC](https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430/4 "2020-07-04T13:41:32Z")

</div>

Yes, that’s what I mean:

```
use_backend staging if { ssl_fc_sni staging.com } url_staging

```

is exactly the same as:

```
use_backend staging if { ssl_fc_sni staging.com } AND url_staging

```

Also see [Using ACLs to form conditions](https://cbonte.github.io/haproxy-dconv/2.0/configuration.html#7.2).

---

<div class="post-metadata">

### Author: ![parwin.bajwa](https://avatars.discourse-cdn.com/v4/letter/p/ecae2f/32.png) [@parwin.bajwa](https://discourse.haproxy.org/u/parwin.bajwa)
#### Post date: [July 4, 2020, 2:31pm UTC](https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430/5 "2020-07-04T14:31:56Z")

</div>

@lukastribus Thanks for your explanation.

---

<div class="post-metadata">

### Author: ![npglobal](https://avatars.discourse-cdn.com/v4/letter/n/eb9ed0/32.png) [@npglobal](https://discourse.haproxy.org/u/npglobal)
#### Post date: [November 12, 2022, 4:46pm UTC](https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430/6 "2022-11-12T16:46:50Z")

</div>

I was trying this ACL inline method with URI match cases, and it was not working on my HAproxy v2.6. Maybe because I’m using it with mixing multiple URIs and multiple DomainNames, _but I’m not sure._

However, following is working fine for my case.

_## Staging ACLs Rules_  
_acl url\_web\_api\_stg path\_beg /web/api_  
_acl url\_portal\_stg path\_beg /portal_  
_acl url\_main\_stg hdr(host) -i [staging.com](http://staging.com)_

_use\_backend be\_82 if url\_web\_api\_stg url\_main\_stg_  
_use\_backend be\_83 if url\_portal\_stg url\_main\_stg_  
_use\_backend be\_84 if url\_main\_stg_

_## Production ACLs Rules_  
_acl url\_web\_api\_prod path\_beg /web/api_  
_acl url\_portal\_prod path\_beg /portal_  
_acl url\_main\_prod hdr(host) -i [production.com](http://production.com)_

_use\_backend be\_85 if url\_web\_api\_prod url\_main\_prod_  
_use\_backend be\_86 if url\_portal\_prod url\_main\_prod_  
_use\_backend be\_87 if url\_main\_prod_

Still, I’m curious to know that why following inline acl rule-set is not working for me:

use\_backend be\_85 if { ssl\_fc\_sni [production.com](http://production.com) } url\_web\_api\_prod  
use\_backend be\_86 if { ssl\_fc\_sni [production.com](http://production.com) } url\_portal\_prod  
use\_backend be\_87 if url\_main\_prod

instead of **be\_85** and **be\_86** , it always sends the traffic to **be\_87** , do I need to change the order?

Thanks

---

<div class="post-metadata">

### Author: ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [November 13, 2022, 9:50am UTC](https://discourse.haproxy.org/t/acl-doesnt-work-with-multiple-condition-beg-path-and/5430/7 "2022-11-13T09:50:50Z")

</div>

Do not use `ssl_fc_sni` when you can use the host header. You need to know TLS SNI behaviour inside out to not run into any corner cases.

That said, I don’t know the rest of your configuration, so it’s impossible for me to say if URI matching would even work.

If you are running in HTTP mode, use HTTP headers only for routing. For example:

```
use_backend be_85 if { hdr(host) -i production.com } url_web_api_prod

```

If it doesn’t work, start by trying to match just one condition and then find out which one of the conditions does not match.

The AND combination between different conditions is not a problem; single conditions very likely are.