.htaccess

# File: .htaccess
# Author: Peter Nilsson (@ittykeys)
# Date: March 18, 2024
# License: © 2024 Peter Nilsson, released under the GPLv3 License. See LICENSE file for details.
# Description: .htaccess for custom errorpages, security, and language management

# Custom error documents
ErrorDocument 400 /errorpages/400.html
ErrorDocument 403 /errorpages/403.html
ErrorDocument 404 /errorpages/404.html
ErrorDocument 405 /errorpages/405.html
ErrorDocument 408 /errorpages/408.html
ErrorDocument 414 /errorpages/414.html
ErrorDocument 500 /errorpages/500.html
ErrorDocument 502 /errorpages/502.html
ErrorDocument 503 /errorpages/503.html
ErrorDocument 504 /errorpages/504.html

# Security
Options -Indexes
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options nosniff
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-FRAME-OPTIONS "sameorigin"
Header set Content-Security-Policy "frame-ancestors 'self';"
Options -Includes

# Serve different versions based on language
RewriteEngine On
RewriteCond %{HTTP:Accept-Language} ^sv [NC]
RewriteRule ^$ /index.html [L]
RewriteRule ^notification.js$ /js/notification_sv.js [L]
RewriteCond %{HTTP:Accept-Language} ^en [NC]
RewriteRule ^$ /index_en.html [L]
RewriteRule ^notification.js$ /js/notification_en.js [L]

# And have a manual switch
RewriteRule ^sv$ /index.html [L]
RewriteRule ^en$ /index_en.html [L]

# Fallback to default version
RewriteRule ^$ /index.html [L]
RewriteRule ^notification.js$ /js/notification_sv.js [L]

#And block access to config.json
<Files "config.json">
    RewriteEngine On
    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} ^https?://([a-z0-9-]+\.)?skaneresa\.se [NC]
    RewriteRule ^ - [L]
    RewriteRule ^ - [F,L]
</Files>