176 lines
6.6 KiB
ApacheConf
176 lines
6.6 KiB
ApacheConf
# protection contre la lecture des répertoires
|
|
Options All -Indexes
|
|
|
|
# Masquer les informations du serveur
|
|
ServerSignature Off
|
|
|
|
|
|
# Protect .htaccess et .htpasswds
|
|
<Files ~ "^.*\.([Hh][Tt][AaPp])">
|
|
order allow,deny
|
|
deny from all
|
|
</Files>
|
|
|
|
# Protect sql files
|
|
<FilesMatch "\.sql">
|
|
Order allow,deny
|
|
Deny from all
|
|
</FilesMatch>
|
|
|
|
|
|
<IfModule mod_mime.c>
|
|
AddType application/vnd.ms-fontobject .eot
|
|
AddType application/x-font-opentype .otf
|
|
AddType image/svg+xml .svg
|
|
AddType application/x-font-ttf .ttf
|
|
AddType application/font-woff .woff
|
|
AddType application/font-woff2 .woff2
|
|
</IfModule>
|
|
|
|
|
|
### FILTRE CONTRE XSS, REDIRECTIONS HTTP, base64_encode, VARIABLE PHP GLOBALS VIA URL, MODIFIER VARIABLE _REQUEST VIA URL, TEST DE FAILLE PHP, INJECTION SQL SIMPLE
|
|
RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
|
|
RewriteCond %{QUERY_STRING} ^(.*)(%3C|<)/?script(.*)$ [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)?javascript(%3A|:)(.*)$ [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)document\.location\.href(.*)$ [OR]
|
|
RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^.*(127\.0).* [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)(https?|ftp|mosConfig)(%3A|:)//(.*)$ [NC,OR] ## ATTENTION A CETTE REGLE. ELLE PEUT CASSER CERTAINES REDIRECTIONS RESSEMBLANT A: http://www.truc.fr/index.php?r=http://www.google.fr ##
|
|
RewriteCond %{QUERY_STRING} ^.*(_encode|localhost|loopback).* [NC,OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)GLOBALS(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)_REQUEST(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
|
|
RewriteCond %{QUERY_STRING} ^(.*)(SELECT(%20|\+)|UNION(%20|\+)ALL|INSERT(%20|\+)|DELETE(%20|\+)|CHAR\(|UPDATE(%20|\+)|REPLACE(%20|\+)|LIMIT(%20|\+)|CONCAT(%20|\+)|DECLARE(%20|\+))(.*)$ [NC]
|
|
RewriteRule (.*) - [F]
|
|
|
|
|
|
|
|
<IfModule mod_headers.c>
|
|
# A TESTER la page n'accepte que les scripts provenant du même nom de domaine et de google.com (par exemple)
|
|
#Header set Content-Security-Policy "script-src 'self' https://www.google.com"
|
|
|
|
# Protection contre le clickjacking. Interdit que le site soit intégré en iframe
|
|
Header always set X-FRAME-OPTIONS "SAMEORIGIN"
|
|
|
|
# Bloque la totalité du contenu lorsqu'une attaque XSS est suspectée
|
|
Header always set X-XSS-Protection "1; mode=block"
|
|
|
|
#Désactive la détection automatique du type des ressources
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
|
|
# protege les cookies d'être modifiés par le client
|
|
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
|
|
</IfModule>
|
|
|
|
# BEGIN DEFLATE COMPRESSION
|
|
<IfModule mod_deflate.c>
|
|
AddOutputFilterByType DEFLATE application/javascript
|
|
AddOutputFilterByType DEFLATE application/rss+xml
|
|
AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
|
|
AddOutputFilterByType DEFLATE application/x-font
|
|
AddOutputFilterByType DEFLATE application/x-font-opentype
|
|
AddOutputFilterByType DEFLATE application/x-font-otf
|
|
AddOutputFilterByType DEFLATE application/x-font-truetype
|
|
AddOutputFilterByType DEFLATE application/x-font-ttf
|
|
AddOutputFilterByType DEFLATE application/font-woff2
|
|
AddOutputFilterByType DEFLATE application/x-javascript
|
|
AddOutputFilterByType DEFLATE application/xhtml+xml
|
|
AddOutputFilterByType DEFLATE application/xml
|
|
AddOutputFilterByType DEFLATE font/opentype
|
|
AddOutputFilterByType DEFLATE font/otf
|
|
AddOutputFilterByType DEFLATE font/ttf
|
|
AddOutputFilterByType DEFLATE image/svg+xml
|
|
AddOutputFilterByType DEFLATE image/x-icon
|
|
AddOutputFilterByType DEFLATE text/css
|
|
AddOutputFilterByType DEFLATE text/html
|
|
AddOutputFilterByType DEFLATE text/javascript
|
|
AddOutputFilterByType DEFLATE text/plain
|
|
AddOutputFilterByType DEFLATE text/xml
|
|
</IfModule>
|
|
# END DEFLATE COMPRESSION
|
|
|
|
<IfModule mod_expires.c>
|
|
ExpiresActive On
|
|
ExpiresDefault "access plus 1 month"
|
|
ExpiresByType text/html "access plus 0 seconds"
|
|
ExpiresByType text/xml "access plus 0 seconds"
|
|
ExpiresByType application/xml "access plus 0 seconds"
|
|
ExpiresByType application/json "access plus 0 seconds"
|
|
ExpiresByType application/pdf "access plus 0 seconds"
|
|
ExpiresByType application/rss+xml "access plus 1 hour"
|
|
ExpiresByType application/atom+xml "access plus 1 hour"
|
|
ExpiresByType application/x-font-ttf "access plus 1 month"
|
|
ExpiresByType font/opentype "access plus 1 month"
|
|
ExpiresByType application/x-font-woff "access plus 1 month"
|
|
ExpiresByType application/x-font-woff2 "access plus 1 month"
|
|
ExpiresByType image/svg+xml "access plus 1 month"
|
|
ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
|
|
ExpiresByType image/jpg "access plus 1 month"
|
|
ExpiresByType image/jpeg "access plus 1 month"
|
|
ExpiresByType image/gif "access plus 1 month"
|
|
ExpiresByType image/png "access plus 1 month"
|
|
ExpiresByType video/ogg "access plus 1 month"
|
|
ExpiresByType audio/ogg "access plus 1 month"
|
|
ExpiresByType video/mp4 "access plus 1 month"
|
|
ExpiresByType video/webm "access plus 1 month"
|
|
ExpiresByType text/css "access plus 6 month"
|
|
ExpiresByType application/javascript "access plus 6 month"
|
|
ExpiresByType application/x-shockwave-flash "access plus 1 week"
|
|
ExpiresByType image/x-icon "access plus 1 week"
|
|
</IfModule>
|
|
|
|
<IfModule mod_headers.c>
|
|
<FilesMatch "\\.(ico|jpe?g|png|gif|swf|svg)$">
|
|
Header set Cache-Control "max-age=2592000, public"
|
|
</FilesMatch>
|
|
<FilesMatch "\\.(css)$">
|
|
Header set Cache-Control "max-age=604800, public"
|
|
</FilesMatch>
|
|
<FilesMatch "\\.(js)$">
|
|
Header set Cache-Control "max-age=604800, private"
|
|
</FilesMatch>
|
|
<filesmatch "\\.(html|htm)$">
|
|
Header set Cache-Control "max-age=5, public"
|
|
</filesmatch>
|
|
<filesmatch "\\.(woff)$">
|
|
Header set Cache-Control "max-age=604800, public"
|
|
</filesmatch>
|
|
</IfModule>
|
|
|
|
|
|
<ifModule mod_gzip.c>
|
|
mod_gzip_on Yes
|
|
mod_gzip_dechunk Yes
|
|
mod_gzip_item_include file .(html?|txt|css|js|php|pl)$
|
|
mod_gzip_item_include handler ^cgi-script$
|
|
mod_gzip_item_include mime ^text/.*
|
|
mod_gzip_item_include mime ^application/x-javascript.*
|
|
mod_gzip_item_exclude mime ^image/.*
|
|
mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
|
|
</ifModule>
|
|
|
|
Header unset Pragma
|
|
FileETag None
|
|
Header unset ETag
|
|
|
|
|
|
<IfModule mod_rewrite.c>
|
|
<IfModule mod_negotiation.c>
|
|
Options -MultiViews -Indexes
|
|
</IfModule>
|
|
|
|
RewriteEngine On
|
|
|
|
# Handle Authorization Header
|
|
RewriteCond %{HTTP:Authorization} .
|
|
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
|
|
|
|
# Redirect Trailing Slashes If Not A Folder...
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteCond %{REQUEST_URI} (.+)/$
|
|
RewriteRule ^ %1 [L,R=301]
|
|
|
|
# Send Requests To Front Controller...
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteRule ^ index.php [L]
|
|
</IfModule>
|