.htaccess

# SPDX-FileCopyrightText: Copyright (C) 2020 Opal Health Informatics Group at the Research Institute of the McGill University Health Centre <john.kildea@mcgill.ca>
#
# SPDX-License-Identifier: AGPL-3.0-or-later

# Force HTTPS is enabled on the server already
# RewriteEngine On
# RewriteCond %{HTTPS} off
# RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/.+$
# RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
# RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
# RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
# RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

# Additional security to lock down files and folders
<FilesMatch "package\.json|package-lock\.json|bower\.json|composer\.json|composer\.lock|\.md">
  Require all denied
</FilesMatch>

# add HTTP Strict Transport Policy Header
# https://infosec.mozilla.org/guidelines/web_security#http-strict-transport-security
Header set Strict-Transport-Security max-age=63072000

# Prevent clickjacking and MIME-Sniffing
# https://infosec.mozilla.org/guidelines/web_security#x-frame-options
Header ADD X-FRAME-OPTIONS DENY
# https://infosec.mozilla.org/guidelines/web_security#x-content-type-options
Header set X-Content-Type-Options nosniff

# Disable deprecated X-XSS-Protection
# https://infosec.mozilla.org/guidelines/web_security#x-xss-protection
Header set X-XSS-Protection "1; mode=block"

# add Content-Security-Policy headers
# https://infosec.mozilla.org/guidelines/web_security#content-security-policy
# generated with https://www.validbot.com/tools/csp-wizard.php
# test with https://observatory.mozilla.org/
Header add Content-Security-Policy "base-uri 'self'; default-src 'none'; font-src 'self'; img-src 'self' data:; object-src data:; frame-src 'self' data:; connect-src 'self' wss://*.firebaseio.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com; script-src 'self' https://*.firebaseio.com; style-src 'self' 'unsafe-inline'; manifest-src 'self'; form-action 'none'; frame-ancestors 'none';"