# DOLD Equivalent Finder - Apache rules for Heart Internet
Options -Indexes
DirectoryIndex index.html

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS (Microsoft sign-in requires it)
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Pass the Authorization header through to PHP
  RewriteCond %{HTTP:Authorization} .
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

  # Never serve the private folder or dotfiles
  RewriteRule ^private(/|$) - [F,L]
  RewriteRule (^|/)\. - [F,L]

  # API routes -> PHP
  RewriteRule ^api/(auth-config|health|me|products)/?$ api/index.php?r=$1 [L,QSA]
</IfModule>

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>
