MyShaarli/.htaccess

# Disable directory listing
Options -Indexes

RewriteEngine On

# Prevent accessing subdirectories not managed by SCM
RewriteRule ^(.git|doxygen|vendor) - [F]

# Forward the "Authorization" HTTP header
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

# REST API
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

<Limit GET POST PUT DELETE OPTIONS>
    Require all granted
</Limit>
<LimitExcept GET POST PUT DELETE OPTIONS>
    Require all denied
</LimitExcept>
htaccess: prevent accessing resources not managed by SCM See: - https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/ - https://stackoverflow.com/questions/2530372/how-do-i-disable-directory-browsing - https://httpd.apache.org/docs/current/mod/mod_rewrite.html Signed-off-by: VirtualTam <virtualtam@flibidi.net> 2018-01-20 16:20:53 +01:00			`# Disable directory listing`
			`Options -Indexes`

REST API structure using Slim framework * REST API routes are handle by Slim. * Every API controller go through ApiMiddleware which handles security. * First service implemented `/info`, for tests purpose. 2016-12-15 10:13:00 +01:00			`RewriteEngine On`
htaccess: prevent accessing resources not managed by SCM See: - https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/ - https://stackoverflow.com/questions/2530372/how-do-i-disable-directory-browsing - https://httpd.apache.org/docs/current/mod/mod_rewrite.html Signed-off-by: VirtualTam <virtualtam@flibidi.net> 2018-01-20 16:20:53 +01:00
			`# Prevent accessing subdirectories not managed by SCM`
			`RewriteRule ^(.git\|doxygen\|vendor) - [F]`

httpd: always forward the 'Authorization' header On some Apache HTTPD setups where the CGI/FastCGI mode is used, the HTTP header containing the JWT token is not forwarded, which results in the following error when attempting to use the REST API: "401 Not authorized: JWT token not provided" This patch allows forwarding the 'Authorization' header. An alternative would be to use the `CGIPassAuth` directive to allow all authorization headers to be forwarded. See: - https://secure.php.net/manual/en/features.http-auth.php#114877 - https://stackoverflow.com/questions/26475885/authorization-header-missing-in-php-post-request - https://stackoverflow.com/questions/13387516/authorization-header-missing-in-django-rest-framework-is-apache-to-blame - https://stackoverflow.com/questions/17018586/apache-2-4-php-fpm-and-authorization-headers - https://httpd.apache.org/docs/2.4/en/mod/core.html#cgipassauth Signed-off-by: VirtualTam <virtualtam@flibidi.net> 2018-03-22 22:23:41 +01:00			`# Forward the "Authorization" HTTP header`
			`RewriteCond %{HTTP:Authorization} ^(.*)`
			`RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]`

htaccess: prevent accessing resources not managed by SCM See: - https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/ - https://stackoverflow.com/questions/2530372/how-do-i-disable-directory-browsing - https://httpd.apache.org/docs/current/mod/mod_rewrite.html Signed-off-by: VirtualTam <virtualtam@flibidi.net> 2018-01-20 16:20:53 +01:00			`# REST API`
REST API structure using Slim framework * REST API routes are handle by Slim. * Every API controller go through ApiMiddleware which handles security. * First service implemented `/info`, for tests purpose. 2016-12-15 10:13:00 +01:00			`RewriteCond %{REQUEST_FILENAME} !-f`
			`RewriteCond %{REQUEST_FILENAME} !-d`
			`RewriteRule ^ index.php [QSA,L]`
API - Apache - Specify allowed HTTP method in .htaccess 2018-07-05 20:47:26 +02:00
			`<Limit GET POST PUT DELETE OPTIONS>`
			`Require all granted`
			`</Limit>`
			`<LimitExcept GET POST PUT DELETE OPTIONS>`
			`Require all denied`
			`</LimitExcept>`