#BEGIN SECURITY HEADERS

# -------------------------------------------------------
# Safe baseline
# -------------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

Options -Indexes

<IfModule mod_headers.c>
  # Reduce fingerprinting
  # The Server header usually cannot be removed from .htaccess; configure it at the web server level if needed.
  Header always unset X-Powered-By
  Header always unset X-Redirect-By

  # TLS / transport security (only when HTTPS)
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" env=HTTPS

  # MIME sniffing protection
  Header always set X-Content-Type-Options "nosniff"

  # Referrer policy
  Header always set Referrer-Policy "strict-origin-when-cross-origin"

  # Adobe cross-domain policy
  Header always set X-Permitted-Cross-Domain-Policies "none"

  # Clickjacking protection (consistent with CSP frame-ancestors 'self')
  Header always set X-Frame-Options "SAMEORIGIN"

  # Cross-Origin isolation headers (sane defaults)
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Cross-Origin-Resource-Policy "same-origin"
  # COEP is powerful but can break third-party embeds/resources if not CORP/CORS-enabled.
  # Header always set Cross-Origin-Embedder-Policy "require-corp"

  # Deprecated header; modern browsers rely on CSP instead, but some scanners still like to see it.
  Header always set X-XSS-Protection "0"

  # Permissions-Policy (balanced: blocks sensitive features, allows reasonable ones on self)
  Header always set Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), display-capture=(), autoplay=(self), encrypted-media=(self), fullscreen=(self), picture-in-picture=(self), clipboard-write=(self), publickey-credentials-get=(self)"

  # Vary (keep small; don’t add Referer/User-Agent unless you truly vary by them)
  Header always merge Vary "Accept-Encoding"
</IfModule>

# -------------------------------------------------------
# Cache-Control (HTML pages)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # Apply to HTML responses (works for WordPress permalinks too). Requires Apache 2.4+ expressions.
  # If you do not use a page cache (LiteSpeed Cache, cache plugins, etc.), you can uncomment the line below. Keep it commented if a page cache is active.
  # Header always set Cache-Control "private, no-cache, must-revalidate" "expr=%{CONTENT_TYPE} =~ m#^text/html#"
  # Header always unset Pragma "expr=%{CONTENT_TYPE} =~ m#^text/html#"
  # Header always unset Expires "expr=%{CONTENT_TYPE} =~ m#^text/html#"
</IfModule>

# -------------------------------------------------------
# CSP - Content Security Policy (minimal safe baseline)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # (Keeps your current intent; strengthen later with default-src/script-src/etc.)
  # Adjust img-src, script-src, style-src, font-src, connect-src as needed (e.g., add trusted CDNs).
  # Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data: https:; script-src 'self'; style-src 'self'; font-src 'self' data:; connect-src 'self'; form-action 'self'; upgrade-insecure-requests"
</IfModule>

# -------------------------------------------------------
# CORS - Cross-Origin Ressource Sharing (optional; keep commented unless needed)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # IMPORTANT:
  # - Do NOT enable global CORS unless you have a real API need.
  # If you need CORS, uncomment and set a fixed allowlist.
  # SetEnvIf Origin "^https?://(kastner\.at|www\.kastner\.at)(:\d{1,5})?$" CORS_ALLOW_ORIGIN=$0
  # Header always set Access-Control-Allow-Origin "%{CORS_ALLOW_ORIGIN}e" env=CORS_ALLOW_ORIGIN
  # Header always merge Vary "Origin" env=CORS_ALLOW_ORIGIN
  # Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS" env=CORS_ALLOW_ORIGIN
  # Header always set Access-Control-Allow-Headers "Content-Type, Authorization" env=CORS_ALLOW_ORIGIN
  # Header always set Access-Control-Max-Age "86400" env=CORS_ALLOW_ORIGIN
</IfModule>

# -------------------------------------------------------
# Cookies hardening (optional)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # Apache only: uses Header edit/edit* to append Secure/HttpOnly/SameSite when missing. Not valid / not supported reliably on LiteSpeed/OpenLiteSpeed.
  # Header always edit* Set-Cookie "(?i)^((?:(?!;\s*Secure).)+)$" "$1; Secure" env=HTTPS
  # Header always edit* Set-Cookie "(?i)^((?:(?!;\s*HttpOnly).)+)$" "$1; HttpOnly"
  # Header always edit* Set-Cookie "(?i)^((?:(?!;\s*SameSite=).)+)$" "$1; SameSite=Lax"
</IfModule>

# -------------------------------------------------------
# Reporting headers (optional)
# -------------------------------------------------------
<IfModule mod_headers.c>
  # Header always set Reporting-Endpoints "default=\"https://kastner.at/reporting\""
  # Header always set Cross-Origin-Opener-Policy-Report-Only "same-origin"
  # Header always set Cross-Origin-Embedder-Policy-Report-Only "require-corp"
</IfModule>

#END SECURITY HEADERS