diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 2fd6697e10..5bff0caa22 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -1,7 +1,7 @@ # Contributing to HTML5 Boilerplate ♥ [HTML5 Boilerplate](https://html5boilerplate.com/) and want to get involved? -Thanks! We're actively looking for folks interested in helping out and there +Thanks! We're actively looking for folks interested in helping out and there are plenty of ways you can help! Please take a moment to review this document in order to make the contribution diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index d1a7953e57..56ba4ef398 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -14,6 +14,6 @@ - [ ] I have added tests to cover my changes. - [ ] All new and existing tests passed. -Pull requests should be thought of as a conversation. There will be some back and forth when trying to get code merged into this or any other project. With all but the simplest changes you can and should expect that the maintainers of the project will request changes to your code. Please be aware of that and check in after you open your PR in order to get your code merged in cleanly. +Pull requests should be thought of as a conversation. There will be some back and forth when trying to get code merged into this or any other project. With all but the simplest changes you can and should expect that the maintainers of the project will request changes to your code. Please be aware of that and check in after you open your PR in order to get your code merged in cleanly. Thanks! diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md index 2fc0cf71de..f205c19ea1 100644 --- a/.github/SUPPORT.md +++ b/.github/SUPPORT.md @@ -2,7 +2,7 @@ For personal support requests with HTML5 Boilerplate please use Stack Overflow ([`html5boilerplate`](https://stackoverflow.com/questions/tagged/html5boilerplate) tag). - + Please check the respective repository/website for support regarding the code in [`.htaccess`](https://github.com/h5bp/server-configs-apache), [`jQuery`](https://jquery.org/support/), diff --git a/dist/.htaccess b/dist/.htaccess index 2a2bacf49a..12a2e0ac14 100644 --- a/dist/.htaccess +++ b/dist/.htaccess @@ -1,4 +1,4 @@ -# Apache Server Configs v3.2.1 | MIT License +# Apache Server Configs v4.0.0 | MIT License # https://github.com/h5bp/server-configs-apache # (!) Using `.htaccess` files slows down Apache, therefore, if you have @@ -21,6 +21,13 @@ # https://enable-cors.org/ # https://www.w3.org/TR/cors/ +# (!) Do not use this without understanding the consequences. +# This will permit access from any other website. +# Instead of using this file, consider using a specific rule such as +# allowing access based on (sub)domain: +# +# Header set Access-Control-Allow-Origin "subdomain.example.com" + # # Header set Access-Control-Allow-Origin "*" # @@ -36,7 +43,7 @@ - + SetEnvIf Origin ":" IS_CORS Header set Access-Control-Allow-Origin "*" env=IS_CORS @@ -63,10 +70,9 @@ # Allow cross-origin access to the timing information for all resources. # -# If a resource isn't served with a `Timing-Allow-Origin` header that -# would allow its timing information to be shared with the document, -# some of the attributes of the `PerformanceResourceTiming` object will -# be set to zero. +# If a resource isn't served with a `Timing-Allow-Origin` header that would +# allow its timing information to be shared with the document, some of the +# attributes of the `PerformanceResourceTiming` object will be set to zero. # # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin # https://www.w3.org/TR/resource-timing/ @@ -96,8 +102,8 @@ ErrorDocument 404 /404.html # Disable the pattern matching based on filenames. # -# This setting prevents Apache from returning a 404 error as the result -# of a rewrite when the directory with the same name does not exist. +# This setting prevents Apache from returning a 404 error as the result of a +# rewrite when the directory with the same name does not exist. # # https://httpd.apache.org/docs/current/content-negotiation.html#multiviews @@ -112,21 +118,21 @@ Options -MultiViews # ---------------------------------------------------------------------- # Force Internet Explorer 8/9/10 to render pages in the highest mode -# available in the various cases when it may not. +# available in various cases when it may not. # # https://hsivonen.fi/doctype/#ie8 # # (!) Starting with Internet Explorer 11, document modes are deprecated. -# If your business still relies on older web apps and services that were -# designed for older versions of Internet Explorer, you might want to -# consider enabling `Enterprise Mode` throughout your company. +# If your business still relies on older web apps and services that were +# designed for older versions of Internet Explorer, you might want to +# consider enabling `Enterprise Mode` throughout your company. # # https://msdn.microsoft.com/en-us/library/ie/bg182625.aspx#docmode # https://blogs.msdn.microsoft.com/ie/2014/04/02/stay-up-to-date-with-enterprise-mode-for-internet-explorer-11/ # https://msdn.microsoft.com/en-us/library/ff955275.aspx - Header set X-UA-Compatible "IE=edge" "expr=%{CONTENT_TYPE} =~ m#text/html#i" + Header always set X-UA-Compatible "IE=edge" "expr=%{CONTENT_TYPE} =~ m#text/html#i" # ###################################################################### @@ -182,8 +188,8 @@ Options -MultiViews AddType video/webm webm AddType video/x-flv flv - # Serving `.ico` image files with a different media type - # prevents Internet Explorer from displaying them as images: + # Serving `.ico` image files with a different media type prevents + # Internet Explorer from displaying them as images: # https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee AddType image/x-icon cur ico @@ -224,8 +230,8 @@ Options -MultiViews # | Character encodings | # ---------------------------------------------------------------------- -# Serve all resources labeled as `text/html` or `text/plain` -# with the media type `charset` parameter set to `UTF-8`. +# Serve all resources labeled as `text/html` or `text/plain` with the media type +# `charset` parameter set to `UTF-8`. # # https://httpd.apache.org/docs/current/mod/core.html#adddefaultcharset @@ -233,8 +239,8 @@ AddDefaultCharset utf-8 # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -# Serve the following file types with the media type `charset` -# parameter set to `UTF-8`. +# Serve the following file types with the media type `charset` parameter set to +# `UTF-8`. # # https://httpd.apache.org/docs/current/mod/mod_mime.html#addcharset @@ -267,8 +273,8 @@ AddDefaultCharset utf-8 # | Rewrite engine | # ---------------------------------------------------------------------- -# (1) Turn on the rewrite engine (this is necessary in order for -# the `RewriteRule` directives to work). +# (1) Turn on the rewrite engine (this is necessary in order for the +# `RewriteRule` directives to work). # # https://httpd.apache.org/docs/current/mod/mod_rewrite.html#RewriteEngine # @@ -276,10 +282,10 @@ AddDefaultCharset utf-8 # # https://httpd.apache.org/docs/current/mod/core.html#options # -# (3) If your web host doesn't allow the `FollowSymlinks` option, -# you need to comment it out or remove it, and then uncomment -# the `Options +SymLinksIfOwnerMatch` line (4), but be aware -# of the performance impact. +# (3) If your web host doesn't allow the `FollowSymlinks` option, you need to +# comment it out or remove it, and then uncomment the +# `Options +SymLinksIfOwnerMatch` line (4), but be aware of the performance +# impact. # # https://httpd.apache.org/docs/current/misc/perf-tuning.html#symlinks # @@ -288,14 +294,10 @@ AddDefaultCharset utf-8 # https://www.rackspace.com/knowledge_center/frequently-asked-question/why-is-modrewrite-not-working-on-my-site # https://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewritebase # -# (5) Depending on how your server is set up, you may also need to -# use the `RewriteOptions` directive to enable some options for -# the rewrite engine. +# (5) Depending on how your server is set up, you may also need to use the +# `RewriteOptions` directive to enable some options for the rewrite engine. # # https://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewriteoptions -# -# (6) Set %{ENV:PROTO} variable, to allow rewrites to redirect with the -# appropriate schema automatically (http or https). @@ -314,12 +316,6 @@ AddDefaultCharset utf-8 # (5) # RewriteOptions - # (6) - RewriteCond %{HTTPS} =on - RewriteRule ^ - [env=proto:https] - RewriteCond %{HTTPS} !=on - RewriteRule ^ - [env=proto:http] - # ---------------------------------------------------------------------- @@ -330,10 +326,9 @@ AddDefaultCharset utf-8 # # https://wiki.apache.org/httpd/RewriteHTTPToHTTPS -# (1) If you're using cPanel AutoSSL or the Let's Encrypt webroot -# method it will fail to validate the certificate if validation -# requests are redirected to HTTPS. Turn on the condition(s) -# you need. +# (1) If you're using cPanel AutoSSL or the Let's Encrypt webroot method it +# will fail to validate the certificate if validation requests are +# redirected to HTTPS. Turn on the condition(s) you need. # # https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml # https://tools.ietf.org/html/draft-ietf-acme-acme-12 @@ -354,27 +349,39 @@ AddDefaultCharset utf-8 # Rewrite www.example.com → example.com -# The same content should never be available under two different -# URLs, especially not with and without `www.` at the beginning. -# This can cause SEO problems (duplicate content), and therefore, -# you should choose one of the alternatives and redirect the other -# one. +# The same content should never be available under two different URLs, +# especially not with and without `www.` at the beginning. +# This can cause SEO problems (duplicate content), and therefore, you should +# choose one of the alternatives and redirect the other one. # # (!) NEVER USE BOTH WWW-RELATED RULES AT THE SAME TIME! -# (1) The rule assumes by default that both HTTP and HTTPS -# environments are available for redirection. -# If your SSL certificate could not handle one of the domains -# used during redirection, you should turn the condition on. +# (1) Set %{ENV:PROTO} variable, to allow rewrites to redirect with the +# appropriate schema automatically (http or https). +# +# (2) The rule assumes by default that both HTTP and HTTPS environments are +# available for redirection. +# If your SSL certificate could not handle one of the domains used during +# redirection, you should turn the condition on. # # https://github.com/h5bp/server-configs-apache/issues/52 + RewriteEngine On + # (1) + RewriteCond %{HTTPS} =on + RewriteRule ^ - [E=PROTO:https] + RewriteCond %{HTTPS} !=on + RewriteRule ^ - [E=PROTO:http] + + # (2) # RewriteCond %{HTTPS} !=on + RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] RewriteRule ^ %{ENV:PROTO}://%1%{REQUEST_URI} [R=301,L] + # ---------------------------------------------------------------------- @@ -383,18 +390,20 @@ AddDefaultCharset utf-8 # Rewrite example.com → www.example.com -# The same content should never be available under two different -# URLs, especially not with and without `www.` at the beginning. -# This can cause SEO problems (duplicate content), and therefore, -# you should choose one of the alternatives and redirect the other -# one. +# The same content should never be available under two different URLs, +# especially not with and without `www.` at the beginning. +# This can cause SEO problems (duplicate content), and therefore, you should +# choose one of the alternatives and redirect the other one. # # (!) NEVER USE BOTH WWW-RELATED RULES AT THE SAME TIME! -# (1) The rule assumes by default that both HTTP and HTTPS -# environments are available for redirection. -# If your SSL certificate could not handle one of the domains -# used during redirection, you should turn the condition on. +# (1) Set %{ENV:PROTO} variable, to allow rewrites to redirect with the +# appropriate schema automatically (http or https). +# +# (2) The rule assumes by default that both HTTP and HTTPS environments are +# available for redirection. +# If your SSL certificate could not handle one of the domains used during +# redirection, you should turn the condition on. # # https://github.com/h5bp/server-configs-apache/issues/52 @@ -402,13 +411,23 @@ AddDefaultCharset utf-8 # subdomains for certain parts of your website. # + # RewriteEngine On + # # (1) +# RewriteCond %{HTTPS} =on +# RewriteRule ^ - [E=PROTO:https] +# RewriteCond %{HTTPS} !=on +# RewriteRule ^ - [E=PROTO:http] + +# # (2) # # RewriteCond %{HTTPS} !=on + # RewriteCond %{HTTP_HOST} !^www\. [NC] # RewriteCond %{SERVER_ADDR} !=127.0.0.1 # RewriteCond %{SERVER_ADDR} !=::1 # RewriteRule ^ %{ENV:PROTO}://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L] + # # ###################################################################### @@ -416,33 +435,32 @@ AddDefaultCharset utf-8 # ###################################################################### # ---------------------------------------------------------------------- -# | Clickjacking | +# | Frame Options | # ---------------------------------------------------------------------- # Protect website against clickjacking. # -# The example below sends the `X-Frame-Options` response header with -# the value `DENY`, informing browsers not to display the content of -# the web page in any frame. +# The example below sends the `X-Frame-Options` response header with the value +# `DENY`, informing browsers not to display the content of the web page in any +# frame. # -# This might not be the best setting for everyone. You should read -# about the other two possible values the `X-Frame-Options` header -# field can have: `SAMEORIGIN` and `ALLOW-FROM`. +# This might not be the best setting for everyone. You should read about the +# other two possible values the `X-Frame-Options` header field can have: +# `SAMEORIGIN` and `ALLOW-FROM`. # https://tools.ietf.org/html/rfc7034#section-2.1. # -# Keep in mind that while you could send the `X-Frame-Options` header -# for all of your website’s pages, this has the potential downside that -# it forbids even non-malicious framing of your content (e.g.: when -# users visit your website using a Google Image Search results page). +# Keep in mind that while you could send the `X-Frame-Options` header for all +# of your website's pages, this has the potential downside that it forbids even +# non-malicious framing of your content (e.g.: when users visit your website +# using a Google Image Search results page). # -# Nonetheless, you should ensure that you send the `X-Frame-Options` -# header for all pages that allow a user to make a state changing -# operation (e.g: pages that contain one-click purchase links, checkout -# or bank-transfer confirmation pages, pages that make permanent -# configuration changes, etc.). +# Nonetheless, you should ensure that you send the `X-Frame-Options` header for +# all pages that allow a user to make a state-changing operation (e.g: pages +# that contain one-click purchase links, checkout or bank-transfer confirmation +# pages, pages that make permanent configuration changes, etc.). # -# Sending the `X-Frame-Options` header can also protect your website -# against more than just clickjacking attacks: +# Sending the `X-Frame-Options` header can also protect your website against +# more than just clickjacking attacks. # https://cure53.de/xfo-clickjacking.pdf. # # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options @@ -451,7 +469,7 @@ AddDefaultCharset utf-8 # https://www.owasp.org/index.php/Clickjacking # -# Header set X-Frame-Options "DENY" "expr=%{CONTENT_TYPE} =~ m#text/html#i" +# Header always set X-Frame-Options "DENY" "expr=%{CONTENT_TYPE} =~ m#text/html#i" # # ---------------------------------------------------------------------- @@ -461,54 +479,60 @@ AddDefaultCharset utf-8 # Mitigate the risk of cross-site scripting and other content-injection # attacks. # -# This can be done by setting a `Content Security Policy` which -# whitelists trusted sources of content for your website. +# This can be done by setting a `Content Security Policy` which whitelists +# trusted sources of content for your website. # -# There is no policy that fits all websites, you will have to modify -# the `Content-Security-Policy` directives in the example below depending -# on your needs. +# There is no policy that fits all websites, you will have to modify the +# `Content-Security-Policy` directives in the example depending on your needs. # # The example policy below aims to: # -# (1) Restrict all fetches by default to the origin of the current website -# by setting the `default-src` directive to `'self'` - which acts as a +# (1) Restrict all fetches by default to the origin of the current website by +# setting the `default-src` directive to `'self'` - which acts as a # fallback to all "Fetch directives" (https://developer.mozilla.org/en-US/docs/Glossary/Fetch_directive). # # This is convenient as you do not have to specify all Fetch directives # that apply to your site, for example: # `connect-src 'self'; font-src 'self'; script-src 'self'; style-src 'self'`, etc. # -# This restriction also means that you must explicitly define from -# which site(s) your website is allowed to load resources from. +# This restriction also means that you must explicitly define from which +# site(s) your website is allowed to load resources from. # -# (2) The `` element is not allowed on the website. This is to -# prevent attackers from changing the locations of resources loaded -# from relative URLs. +# (2) The `` element is not allowed on the website. This is to prevent +# attackers from changing the locations of resources loaded from relative +# URLs. # -# If you want to use the `` element, then `base-uri 'self'` -# can be used instead. +# If you want to use the `` element, then `base-uri 'self'` can be +# used instead. # -# (3) Form submissions are only allowed from the current website by -# setting: `form-action 'self'`. +# (3) Form submissions are only allowed from the current website by setting: +# `form-action 'self'`. # -# (4) Prevents all websites (including your own) from embedding your -# webpages within e.g. the `