3f2823a764
The PHP app runs on Cafe24 shared web hosting -- calling it 'cloud' was misleading. Renames the directory, the edge client module, and every doc/script/identifier that used the term. - cloud/ -> server/ (incl. server/deploy/build_cafe24_package.sh paths) - edge/cloudclient.py -> edge/serverclient.py, CloudClient -> ServerClient - cloud/docs/cloud-deploy.md -> server/docs/server-deploy.md - CLOUD_* env/config keys -> SERVER_* - tests renamed to match Tests: PHP 109 pass (4 skipped), pytest 167 pass. dist/ regenerated.
64 lines
2.7 KiB
Text
64 lines
2.7 KiB
Text
# move-detect cloud — belongs in the DocumentRoot (Cafe24: /home/hosting_users/<ID>/www/).
|
|
# Built into the upload package as www/.htaccess by build_cafe24_package.sh.
|
|
#
|
|
# mod_rewrite is confirmed on Cafe24 web hosting. mod_headers and mod_authz_core are not,
|
|
# so every dependent block is wrapped in <IfModule> and degrades instead of 500-ing.
|
|
|
|
<IfModule mod_rewrite.c>
|
|
RewriteEngine On
|
|
|
|
# 1) Force HTTPS. This is REQUIRED, not hardening: src/Auth/Session.php hard-codes
|
|
# 'cookie_secure' => true, so over plain HTTP the browser never sends the session
|
|
# cookie back — login appears to succeed, then silently loses the session on the very
|
|
# next request. All three conditions must hold before redirecting, so a TLS-terminating
|
|
# proxy that sets any one of them cannot trigger a redirect loop.
|
|
# R=302 on purpose. Promote to R=301 only after verifying in a real browser: a wrong
|
|
# 301 is cached by clients and is very hard to walk back.
|
|
RewriteCond %{HTTPS} !=on
|
|
RewriteCond %{SERVER_PORT} !^443$
|
|
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
|
|
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]
|
|
|
|
# 2) Front controller — every non-file, non-directory path goes to index.php.
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteRule ^ index.php [QSA,L]
|
|
</IfModule>
|
|
|
|
<IfModule mod_headers.c>
|
|
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set X-Frame-Options "DENY"
|
|
Header always set Referrer-Policy "no-referrer"
|
|
</IfModule>
|
|
|
|
# 3) No directory listings. Backstop against an unauthenticated listing of
|
|
# storage/snapshots/ (JPEGs of people at work) if it is ever misplaced under the docroot.
|
|
Options -Indexes
|
|
|
|
# 4) Deny dotfiles (.git, .env, .htaccess, .user.ini, .phpunit.result.cache, ...).
|
|
<FilesMatch "^\.">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order allow,deny
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# 5) Deny anything Apache would serve as PLAINTEXT for lack of a handler. schema.sql is the
|
|
# sharp one: it is full DDL, and unlike a .php file PHP would not swallow it.
|
|
<FilesMatch "\.(sql|md|json|lock|dist|ini|log|sh|ya?ml|cache)$">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order allow,deny
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# NOTE: there are deliberately no deny rules for src/ vendor/ storage/ config.php here.
|
|
# Those live OUTSIDE the DocumentRoot (siblings of www/), where no .htaccess under www/
|
|
# could reach them and none is needed. Placement is the control; keep them out of www/.
|