.htaccess 2.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182
  1. <IfModule mod_headers.c>
  2. <IfModule mod_setenvif.c>
  3. <IfModule mod_fcgid.c>
  4. SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1
  5. RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION
  6. </IfModule>
  7. <IfModule mod_proxy_fcgi.c>
  8. SetEnvIfNoCase Authorization "(.+)" HTTP_AUTHORIZATION=$1
  9. </IfModule>
  10. </IfModule>
  11. <IfModule mod_env.c>
  12. # Add security and privacy related headers
  13. # Avoid doubled headers by unsetting headers in "onsuccess" table,
  14. # then add headers to "always" table: https://github.com/nextcloud/server/pull/19002
  15. Header onsuccess unset Referrer-Policy
  16. Header always set Referrer-Policy "no-referrer"
  17. Header onsuccess unset X-Content-Type-Options
  18. Header always set X-Content-Type-Options "nosniff"
  19. Header onsuccess unset X-Download-Options
  20. Header always set X-Download-Options "noopen"
  21. Header onsuccess unset X-Frame-Options
  22. Header always set X-Frame-Options "SAMEORIGIN"
  23. Header onsuccess unset X-Permitted-Cross-Domain-Policies
  24. Header always set X-Permitted-Cross-Domain-Policies "none"
  25. Header onsuccess unset X-Robots-Tag
  26. Header always set X-Robots-Tag "none"
  27. Header onsuccess unset X-XSS-Protection
  28. Header always set X-XSS-Protection "1; mode=block"
  29. SetEnv modHeadersAvailable true
  30. </IfModule>
  31. # Add cache control for static resources
  32. <FilesMatch "\.(css|js|svg|gif)$">
  33. Header set Cache-Control "max-age=15778463"
  34. </FilesMatch>
  35. # Let browsers cache WOFF files for a week
  36. <FilesMatch "\.woff2?$">
  37. Header set Cache-Control "max-age=604800"
  38. </FilesMatch>
  39. </IfModule>
  40. <IfModule mod_php7.c>
  41. php_value mbstring.func_overload 0
  42. php_value default_charset 'UTF-8'
  43. php_value output_buffering 0
  44. <IfModule mod_env.c>
  45. SetEnv htaccessWorking true
  46. </IfModule>
  47. </IfModule>
  48. <IfModule mod_rewrite.c>
  49. RewriteEngine on
  50. RewriteCond %{HTTP_USER_AGENT} DavClnt
  51. RewriteRule ^$ /remote.php/webdav/ [L,R=302]
  52. RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  53. RewriteRule ^\.well-known/carddav /remote.php/dav/ [R=301,L]
  54. RewriteRule ^\.well-known/caldav /remote.php/dav/ [R=301,L]
  55. RewriteRule ^remote/(.*) remote.php [QSA,L]
  56. RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
  57. RewriteRule ^\.well-known/(?!acme-challenge|pki-validation) /index.php [QSA,L]
  58. RewriteRule ^(?:\.(?!well-known)|autotest|occ|issue|indie|db_|console).* - [R=404,L]
  59. </IfModule>
  60. <IfModule mod_mime.c>
  61. AddType image/svg+xml svg svgz
  62. AddEncoding gzip svgz
  63. </IfModule>
  64. <IfModule mod_dir.c>
  65. DirectoryIndex index.php index.html
  66. </IfModule>
  67. AddDefaultCharset utf-8
  68. Options -Indexes
  69. <IfModule pagespeed_module>
  70. ModPagespeed Off
  71. </IfModule>