############################################
# Apache Security Hardening for Laravel
############################################

<IfModule mod_headers.c>

    # Remove server fingerprinting
    Header always unset X-Powered-By
    Header always unset Server

    # Clickjacking protection
    Header always set X-Frame-Options "SAMEORIGIN"

    # Prevent MIME sniffing
    Header always set X-Content-Type-Options "nosniff"

    # Referrer policy
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Permissions Policy (modern replacement of Feature-Policy)
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

    # HSTS (ENABLE ONLY ON PRODUCTION DOMAIN WITH VALID SSL)
    # Comment this block on localhost / .test
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

</IfModule>

############################################
# Force Static Files Through Security Headers
############################################
<FilesMatch "\.(txt|xml|json)$">
    <IfModule mod_headers.c>
        Header always unset Server
        Header always unset X-Powered-By
    </IfModule>
</FilesMatch>

############################################
# User-Agent Hardening (ZAP Fuzzer Safe)
############################################
<IfModule mod_headers.c>
    # Remove non-printable characters
    RequestHeader edit User-Agent "[^\x20-\x7E]" ""

    # Limit User-Agent length
    RequestHeader edit User-Agent "^(.{0,512}).*" "$1"
</IfModule>


############################################
# Browser Caching
############################################
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 2 days"

    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresByType image/gif "access plus 1 week"
    ExpiresByType image/png "access plus 1 week"
    ExpiresByType image/jpg "access plus 1 week"
    ExpiresByType image/jpeg "access plus 1 week"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType text/javascript "access plus 1 year"
</IfModule>


############################################
# Laravel Front Controller
############################################
<IfModule mod_rewrite.c>
    Options -MultiViews
    RewriteEngine On

    # Force HTTPS (PRODUCTION ONLY)
    # Comment on localhost / .test
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Remove trailing slash if not a directory
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.+)/$ /$1 [L,R=301]

    # Send all requests to index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L]

    # Authorization header fix (JWT / API)
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>


############################################
# Protect Sensitive Files
############################################
<FilesMatch "(^\.|composer\.(json|lock)|package\.json|package-lock\.json|yarn\.lock|phpunit\.xml|\.env)">
    Require all denied
</FilesMatch>
