edits
[tools.git] / .htaccess
Maxious 1 # Apache configuration file
2 # httpd.apache.org/docs/2.2/mod/quickreference.html
3
4 # Note .htaccess files are an overhead, this logic should be in your Apache
5 # config if possible: httpd.apache.org/docs/2.2/howto/htaccess.html
6
7 # Techniques in here adapted from all over, including:
8 # Kroc Camen: camendesign.com/.htaccess
9 # perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/
10 # Sample .htaccess file of CMS MODx: modxcms.com
11
12
13 # ----------------------------------------------------------------------
14 # Better website experience for IE users
15 # ----------------------------------------------------------------------
16
17 # Force the latest IE version, in various cases when it may fall back to IE7 mode
18 # github.com/rails/rails/commit/123eb25#commitcomment-118920
19 # Use ChromeFrame if it's installed for a better experience for the poor IE folk
20
21 <IfModule mod_headers.c>
22 Header set X-UA-Compatible "IE=Edge,chrome=1"
23 # mod_headers can't match by content-type, but we don't want to send this header on *everything*...
24 <FilesMatch "\.(js|css|gif|png|jpe?g|pdf|xml|oga|ogg|m4a|ogv|mp4|m4v|webm|svg|svgz|eot|ttf|otf|woff|ico|webp|appcache|manifest|htc|crx|oex|xpi|safariextz|vcf)$" >
25 Header unset X-UA-Compatible
26 </FilesMatch>
27 </IfModule>
28
29
30 # ----------------------------------------------------------------------
31 # Cross-domain AJAX requests
32 # ----------------------------------------------------------------------
33
34 # Serve cross-domain Ajax requests, disabled by default.
35 # enable-cors.org
36 # code.google.com/p/html5security/wiki/CrossOriginRequestSecurity
37
38 # <IfModule mod_headers.c>
39 # Header set Access-Control-Allow-Origin "*"
40 # </IfModule>
41
42
43 # ----------------------------------------------------------------------
44 # CORS-enabled images (@crossorigin)
45 # ----------------------------------------------------------------------
46
47 # Send CORS headers if browsers request them; enabled by default for images.
48 # developer.mozilla.org/en/CORS_Enabled_Image
49 # blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html
50 # hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/
51 # wiki.mozilla.org/Security/Reviews/crossoriginAttribute
52
53 <IfModule mod_setenvif.c>
54 <IfModule mod_headers.c>
55 # mod_headers, y u no match by Content-Type?!
56 <FilesMatch "\.(gif|png|jpe?g|svg|svgz|ico|webp)$">
57 SetEnvIf Origin ":" IS_CORS
58 Header set Access-Control-Allow-Origin "*" env=IS_CORS
59 </FilesMatch>
60 </IfModule>
61 </IfModule>
62
63
64 # ----------------------------------------------------------------------
65 # Webfont access
66 # ----------------------------------------------------------------------
67
68 # Allow access from all domains for webfonts.
69 # Alternatively you could only whitelist your
70 # subdomains like "subdomain.example.com".
71
72 <IfModule mod_headers.c>
73 <FilesMatch "\.(ttf|ttc|otf|eot|woff|font.css)$">
74 Header set Access-Control-Allow-Origin "*"
75 </FilesMatch>
76 </IfModule>
77
78
79 # ----------------------------------------------------------------------
80 # Proper MIME type for all files
81 # ----------------------------------------------------------------------
82
83 # JavaScript
84 # Normalize to standard type (it's sniffed in IE anyways)
85 # tools.ietf.org/html/rfc4329#section-7.2
86 AddType application/javascript js jsonp
87 AddType application/json json
88
89 # Audio
90 AddType audio/ogg oga ogg
91 AddType audio/mp4 m4a f4a f4b
92
93 # Video
94 AddType video/ogg ogv
95 AddType video/mp4 mp4 m4v f4v f4p
96 AddType video/webm webm
97 AddType video/x-flv flv
98
99 # SVG
100 # Required for svg webfonts on iPad
101 # twitter.com/FontSquirrel/status/14855840545
102 AddType image/svg+xml svg svgz
103 AddEncoding gzip svgz
104
105 # Webfonts
106 AddType application/vnd.ms-fontobject eot
107 AddType application/x-font-ttf ttf ttc
108 AddType font/opentype otf
109 AddType application/x-font-woff woff
110
111 # Assorted types
112 AddType image/x-icon ico
113 AddType image/webp webp
114 AddType text/cache-manifest appcache manifest
115 AddType text/x-component htc
116 AddType application/xml rss atom xml rdf
117 AddType application/x-chrome-extension crx
118 AddType application/x-opera-extension oex
119 AddType application/x-xpinstall xpi
120 AddType application/octet-stream safariextz
121 AddType application/x-web-app-manifest+json webapp
122 AddType text/x-vcard vcf
123 AddType application/x-shockwave-flash swf
124 AddType text/vtt vtt
125
126
127 # ----------------------------------------------------------------------
128 # Allow concatenation from within specific js and css files
129 # ----------------------------------------------------------------------
130
131 # e.g. Inside of script.combined.js you could have
132 # <!--#include file="libs/jquery-1.5.0.min.js" -->
133 # <!--#include file="plugins/jquery.idletimer.js" -->
134 # and they would be included into this single file.
135
136 # This is not in use in the boilerplate as it stands. You may
137 # choose to use this technique if you do not have a build process.
138
139 #<FilesMatch "\.combined\.js$">
140 # Options +Includes
141 # AddOutputFilterByType INCLUDES application/javascript application/json
142 # SetOutputFilter INCLUDES
143 #</FilesMatch>
144
145 #<FilesMatch "\.combined\.css$">
146 # Options +Includes
147 # AddOutputFilterByType INCLUDES text/css
148 # SetOutputFilter INCLUDES
149 #</FilesMatch>
150
151
152 # ----------------------------------------------------------------------
153 # Gzip compression
154 # ----------------------------------------------------------------------
155
156 <IfModule mod_deflate.c>
157
158 # Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/
159 <IfModule mod_setenvif.c>
160 <IfModule mod_headers.c>
161 SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
162 RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
163 </IfModule>
164 </IfModule>
165
166 # Compress all output labeled with one of the following MIME-types
167 <IfModule mod_filter.c>
168 AddOutputFilterByType DEFLATE application/atom+xml \
169 application/javascript \
170 application/json \
171 application/rss+xml \
172 application/vnd.ms-fontobject \
173 application/x-font-ttf \
174 application/xhtml+xml \
175 application/xml \
176 font/opentype \
177 image/svg+xml \
178 image/x-icon \
179 text/css \
180 text/html \
181 text/plain \
182 text/x-component \
183 text/xml
184 </IfModule>
185
186 </IfModule>
187
188
189 # ----------------------------------------------------------------------
190 # Expires headers (for better cache control)
191 # ----------------------------------------------------------------------
192
193 # These are pretty far-future expires headers.
194 # They assume you control versioning with filename-based cache busting
195 # Additionally, consider that outdated proxies may miscache
196 # www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/
197
198 # If you don't use filenames to version, lower the CSS and JS to something like
199 # "access plus 1 week".
200
201 <IfModule mod_expires.c>
202 ExpiresActive on
203
204 # Perhaps better to whitelist expires rules? Perhaps.
205 ExpiresDefault "access plus 1 month"
206
207 # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)
208 ExpiresByType text/cache-manifest "access plus 0 seconds"
209
210 # Your document html
211 ExpiresByType text/html "access plus 0 seconds"
212
213 # Data
214 ExpiresByType text/xml "access plus 0 seconds"
215 ExpiresByType application/xml "access plus 0 seconds"
216 ExpiresByType application/json "access plus 0 seconds"
217
218 # Feed
219 ExpiresByType application/rss+xml "access plus 1 hour"
220 ExpiresByType application/atom+xml "access plus 1 hour"
221
222 # Favicon (cannot be renamed)
223 ExpiresByType image/x-icon "access plus 1 week"
224