|
Maxious
|
1 |
# Apache configuration file |
|
|
2 |
# httpd.apache.org/docs/2.2/mod/quickreference.html |
|
|
3 |
|
|
|
4 |
# Note .htaccess files are an overhead, this logic should be in your Apache |
|
|
5 |
# config if possible: httpd.apache.org/docs/2.2/howto/htaccess.html |
|
|
6 |
|
|
|
7 |
# Techniques in here adapted from all over, including: |
|
|
8 |
# Kroc Camen: camendesign.com/.htaccess |
|
|
9 |
# perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/ |
|
|
10 |
# Sample .htaccess file of CMS MODx: modxcms.com |
|
|
11 |
|
|
|
12 |
|
|
|
13 |
# ---------------------------------------------------------------------- |
|
|
14 |
# Better website experience for IE users |
|
|
15 |
# ---------------------------------------------------------------------- |
|
|
16 |
|
|
|
17 |
# Force the latest IE version, in various cases when it may fall back to IE7 mode |
|
|
18 |
# github.com/rails/rails/commit/123eb25#commitcomment-118920 |
|
|
19 |
# Use ChromeFrame if it's installed for a better experience for the poor IE folk |
|
|
20 |
|
|
|
21 |
<IfModule mod_headers.c> |
|
|
22 |
Header set X-UA-Compatible "IE=Edge,chrome=1" |
|
|
23 |
# mod_headers can't match by content-type, but we don't want to send this header on *everything*... |
|
|
24 |
<FilesMatch "\.(js|css|gif|png|jpe?g|pdf|xml|oga|ogg|m4a|ogv|mp4|m4v|webm|svg|svgz|eot|ttf|otf|woff|ico|webp|appcache|manifest|htc|crx|oex|xpi|safariextz|vcf)$" > |
|
|
25 |
Header unset X-UA-Compatible |
|
|
26 |
</FilesMatch> |
|
|
27 |
</IfModule> |
|
|
28 |
|
|
|
29 |
|
|
|
30 |
# ---------------------------------------------------------------------- |
|
|
31 |
# Cross-domain AJAX requests |
|
|
32 |
# ---------------------------------------------------------------------- |
|
|
33 |
|
|
|
34 |
# Serve cross-domain Ajax requests, disabled by default. |
|
|
35 |
# enable-cors.org |
|
|
36 |
# code.google.com/p/html5security/wiki/CrossOriginRequestSecurity |
|
|
37 |
|
|
|
38 |
# <IfModule mod_headers.c> |
|
|
39 |
# Header set Access-Control-Allow-Origin "*" |
|
|
40 |
# </IfModule> |
|
|
41 |
|
|
|
42 |
|
|
|
43 |
# ---------------------------------------------------------------------- |
|
|
44 |
# CORS-enabled images (@crossorigin) |
|
|
45 |
# ---------------------------------------------------------------------- |
|
|
46 |
|
|
|
47 |
# Send CORS headers if browsers request them; enabled by default for images. |
|
|
48 |
# developer.mozilla.org/en/CORS_Enabled_Image |
|
|
49 |
# blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html |
|
|
50 |
# hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/ |
|
|
51 |
# wiki.mozilla.org/Security/Reviews/crossoriginAttribute |
|
|
52 |
|
|
|
53 |
<IfModule mod_setenvif.c> |
|
|
54 |
<IfModule mod_headers.c> |
|
|
55 |
# mod_headers, y u no match by Content-Type?! |
|
|
56 |
<FilesMatch "\.(gif|png|jpe?g|svg|svgz|ico|webp)$"> |
|
|
57 |
SetEnvIf Origin ":" IS_CORS |
|
|
58 |
Header set Access-Control-Allow-Origin "*" env=IS_CORS |
|
|
59 |
</FilesMatch> |
|
|
60 |
</IfModule> |
|
|
61 |
</IfModule> |
|
|
62 |
|
|
|
63 |
|
|
|
64 |
# ---------------------------------------------------------------------- |
|
|
65 |
# Webfont access |
|
|
66 |
# ---------------------------------------------------------------------- |
|
|
67 |
|
|
|
68 |
# Allow access from all domains for webfonts. |
|
|
69 |
# Alternatively you could only whitelist your |
|
|
70 |
# subdomains like "subdomain.example.com". |
|
|
71 |
|
|
|
72 |
<IfModule mod_headers.c> |
|
|
73 |
<FilesMatch "\.(ttf|ttc|otf|eot|woff|font.css)$"> |
|
|
74 |
Header set Access-Control-Allow-Origin "*" |
|
|
75 |
</FilesMatch> |
|
|
76 |
</IfModule> |
|
|
77 |
|
|
|
78 |
|
|
|
79 |
# ---------------------------------------------------------------------- |
|
|
80 |
# Proper MIME type for all files |
|
|
81 |
# ---------------------------------------------------------------------- |
|
|
82 |
|
|
|
83 |
# JavaScript |
|
|
84 |
# Normalize to standard type (it's sniffed in IE anyways) |
|
|
85 |
# tools.ietf.org/html/rfc4329#section-7.2 |
|
|
86 |
AddType application/javascript js jsonp |
|
|
87 |
AddType application/json json |
|
|
88 |
|
|
|
89 |
# Audio |
|
|
90 |
AddType audio/ogg oga ogg |
|
|
91 |
AddType audio/mp4 m4a f4a f4b |
|
|
92 |
|
|
|
93 |
# Video |
|
|
94 |
AddType video/ogg ogv |
|
|
95 |
AddType video/mp4 mp4 m4v f4v f4p |
|
|
96 |
AddType video/webm webm |
|
|
97 |
AddType video/x-flv flv |
|
|
98 |
|
|
|
99 |
# SVG |
|
|
100 |
# Required for svg webfonts on iPad |
|
|
101 |
# twitter.com/FontSquirrel/status/14855840545 |
|
|
102 |
AddType image/svg+xml svg svgz |
|
|
103 |
AddEncoding gzip svgz |
|
|
104 |
|
|
|
105 |
# Webfonts |
|
|
106 |
AddType application/vnd.ms-fontobject eot |
|
|
107 |
AddType application/x-font-ttf ttf ttc |
|
|
108 |
AddType font/opentype otf |
|
|
109 |
AddType application/x-font-woff woff |
|
|
110 |
|
|
|
111 |
# Assorted types |
|
|
112 |
AddType image/x-icon ico |
|
|
113 |
AddType image/webp webp |
|
|
114 |
AddType text/cache-manifest appcache manifest |
|
|
115 |
AddType text/x-component htc |
|
|
116 |
AddType application/xml rss atom xml rdf |
|
|
117 |
AddType application/x-chrome-extension crx |
|
|
118 |
AddType application/x-opera-extension oex |
|
|
119 |
AddType application/x-xpinstall xpi |
|
|
120 |
AddType application/octet-stream safariextz |
|
|
121 |
AddType application/x-web-app-manifest+json webapp |
|
|
122 |
AddType text/x-vcard vcf |
|
|
123 |
AddType application/x-shockwave-flash swf |
|
|
124 |
AddType text/vtt vtt |
|
|
125 |
|
|
|
126 |
|
|
|
127 |
# ---------------------------------------------------------------------- |
|
|
128 |
# Allow concatenation from within specific js and css files |
|
|
129 |
# ---------------------------------------------------------------------- |
|
|
130 |
|
|
|
131 |
# e.g. Inside of script.combined.js you could have |
|
|
132 |
# <!--#include file="libs/jquery-1.5.0.min.js" --> |
|
|
133 |
# <!--#include file="plugins/jquery.idletimer.js" --> |
|
|
134 |
# and they would be included into this single file. |
|
|
135 |
|
|
|
136 |
# This is not in use in the boilerplate as it stands. You may |
|
|
137 |
# choose to use this technique if you do not have a build process. |
|
|
138 |
|
|
|
139 |
#<FilesMatch "\.combined\.js$"> |
|
|
140 |
# Options +Includes |
|
|
141 |
# AddOutputFilterByType INCLUDES application/javascript application/json |
|
|
142 |
# SetOutputFilter INCLUDES |
|
|
143 |
#</FilesMatch> |
|
|
144 |
|
|
|
145 |
#<FilesMatch "\.combined\.css$"> |
|
|
146 |
# Options +Includes |
|
|
147 |
# AddOutputFilterByType INCLUDES text/css |
|
|
148 |
# SetOutputFilter INCLUDES |
|
|
149 |
#</FilesMatch> |
|
|
150 |
|
|
|
151 |
|
|
|
152 |
# ---------------------------------------------------------------------- |
|
|
153 |
# Gzip compression |
|
|
154 |
# ---------------------------------------------------------------------- |
|
|
155 |
|
|
|
156 |
<IfModule mod_deflate.c> |
|
|
157 |
|
|
|
158 |
# Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/ |
|
|
159 |
<IfModule mod_setenvif.c> |
|
|
160 |
<IfModule mod_headers.c> |
|
|
161 |
SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding |
|
|
162 |
RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding |
|
|
163 |
</IfModule> |
|
|
164 |
</IfModule> |
|
|
165 |
|
|
|
166 |
# Compress all output labeled with one of the following MIME-types |
|
|
167 |
<IfModule mod_filter.c> |
|
|
168 |
AddOutputFilterByType DEFLATE application/atom+xml \ |
|
|
169 |
application/javascript \ |
|
|
170 |
application/json \ |
|
|
171 |
application/rss+xml \ |
|
|
172 |
application/vnd.ms-fontobject \ |
|
|
173 |
application/x-font-ttf \ |
|
|
174 |
application/xhtml+xml \ |
|
|
175 |
application/xml \ |
|
|
176 |
font/opentype \ |
|
|
177 |
image/svg+xml \ |
|
|
178 |
image/x-icon \ |
|
|
179 |
text/css \ |
|
|
180 |
text/html \ |
|
|
181 |
text/plain \ |
|
|
182 |
text/x-component \ |
|
|
183 |
text/xml |
|
|
184 |
</IfModule> |
|
|
185 |
|
|
|
186 |
</IfModule> |
|
|
187 |
|
|
|
188 |
|
|
|
189 |
# ---------------------------------------------------------------------- |
|
|
190 |
# Expires headers (for better cache control) |
|
|
191 |
# ---------------------------------------------------------------------- |
|
|
192 |
|
|
|
193 |
# These are pretty far-future expires headers. |
|
|
194 |
# They assume you control versioning with filename-based cache busting |
|
|
195 |
# Additionally, consider that outdated proxies may miscache |
|
|
196 |
# www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/ |
|
|
197 |
|
|
|
198 |
# If you don't use filenames to version, lower the CSS and JS to something like |
|
|
199 |
# "access plus 1 week". |
|
|
200 |
|
|
|
201 |
<IfModule mod_expires.c> |
|
|
202 |
ExpiresActive on |
|
|
203 |
|
|
|
204 |
# Perhaps better to whitelist expires rules? Perhaps. |
|
|
205 |
ExpiresDefault "access plus 1 month" |
|
|
206 |
|
|
|
207 |
# cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5) |
|
|
208 |
ExpiresByType text/cache-manifest "access plus 0 seconds" |
|
|
209 |
|
|
|
210 |
# Your document html |
|
|
211 |
ExpiresByType text/html "access plus 0 seconds" |
|
|
212 |
|
|
|
213 |
# Data |
|
|
214 |
ExpiresByType text/xml "access plus 0 seconds" |
|
|
215 |
ExpiresByType application/xml "access plus 0 seconds" |
|
|
216 |
ExpiresByType application/json "access plus 0 seconds" |
|
|
217 |
|
|
|
218 |
# Feed |
|
|
219 |
ExpiresByType application/rss+xml "access plus 1 hour" |
|
|
220 |
ExpiresByType application/atom+xml "access plus 1 hour" |
|
|
221 |
|
|
|
222 |
# Favicon (cannot be renamed) |
|
|
223 |
ExpiresByType image/x-icon "access plus 1 week" |
|
|
224 |
|