Apache SetEnvIf failing to match Request_Uri

The issue you are facing is maybe caused by mod_rewrite as explained under. Rewrite rules are applied before applying setenv, so that the rewritten request uri is passed to it. Try to set the env variable on rewrite.

Second argument to SetEnvIf is supposed to be regexp, so it should read as:

SetEnvIf Request_URI ^/path/to/something.* access_granted

your second attempt:

 SetEnvIf Request_URI "^/path/*" access_granted

works because indeed you have 0 or more "/" symbols following /path

In other words - you've attempted to use shell globs where regexp is expected.

I know it's an old topic, but I came across it on my current research, maybe others will have related issues...

For me the following code worked fine and the expression was matched after rewrites!

URL: www.example.de/lockthissite/

.htaccess code:

SetEnvIfNoCase Request_URI ^/lockthissite/$ SECURED=yes

AuthType Basic 
AuthName "restricted access" 
AuthUserFile /path/to/my/.htpasswd 
Require valid-user 
Satisfy any 
Order allow,deny 
Allow from all
Deny from env=SECURED