SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1 RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION SetEnvIfNoCase Authorization "(.+)" HTTP_AUTHORIZATION=$1 SetEnvIfNoCase ^Authorization$ "(.+)" XAUTHORIZATION=$1 RequestHeader set XAuthorization %{XAUTHORIZATION}e env=XAUTHORIZATION # Add security and privacy related headers # Avoid doubled headers by unsetting headers in "onsuccess" table, # then add headers to "always" table: https://github.com/nextcloud/server/pull/19002 # Only on the login page we need any Origin or Referer header set. Header onsuccess unset Referrer-Policy Header always set Referrer-Policy "same-origin" Header onsuccess unset Referrer-Policy Header always set Referrer-Policy "no-referrer" Header onsuccess unset X-Content-Type-Options Header always set X-Content-Type-Options "nosniff" Header onsuccess unset X-Frame-Options Header always set X-Frame-Options "SAMEORIGIN" Header onsuccess unset X-Permitted-Cross-Domain-Policies Header always set X-Permitted-Cross-Domain-Policies "none" Header onsuccess unset X-Robots-Tag Header always set X-Robots-Tag "noindex, nofollow" SetEnv modHeadersAvailable true # Add cache control for static resources Header set Cache-Control "max-age=15778463, immutable" Header set Cache-Control "max-age=15778463" # Let browsers cache OTF and WOFF files for a week Header set Cache-Control "max-age=604800" php_value default_charset 'UTF-8' php_value output_buffering 0 SetEnv htaccessWorking true AddType image/svg+xml svg svgz AddType application/wasm wasm AddEncoding gzip svgz # Serve ESM javascript files (.mjs) with correct mime type AddType text/javascript js mjs DirectoryIndex index.php index.html ModPagespeed Off ############# #### Rewrites ############# RewriteEngine on ## ## Rule: Workaround for WebDAV with apache+php-cgi ## ## Context: ## - Sets the environment variable `HTTP_AUTHORIZATION` to the value of the `Authorization` request header ## - Always executed before and along with other rules (no `L` used) ## - XXX: *May* be replaced with an equivalent SetEnvIf in theory ## - XXX: SetEnvIf approach is already in use above for mod_proxy_cgi / mod_lsapi / mod_fcgid ## RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}] ## ## Rule: Workaround for WebDAV with MS DavClnt ## ## Context: ## - DavClnt attempts an OPTIONS request against `/` instead of the specified endpoint ## - Redirects the client to the endpoint rather than the login page (which confuses DavClnt) ## RewriteCond %{HTTP_USER_AGENT} DavClnt RewriteRule ^$ /remote.php/webdav/ [L,R=302] ## ## Rule: Map the RFC 8615 / RFC 6764 compliant well-known URI for CardDAV to our Remote DAV endpoint ## RewriteRule ^\.well-known/carddav /remote.php/dav/ [R=301,L] ## ## Rule: Map the RFC 8615 / RFC 6764 compliant well-known URI for CalDAV to our Remote DAV endpoint ## RewriteRule ^\.well-known/caldav /remote.php/dav/ [R=301,L] ## ## Rule: Map /remote* --> /remote.php* including the query string ## ## Context: ## - XXX: `QSA` seems unnecessary (no-op) here (query string is passed by default when the replacement URI doesn't contain a query string) ## - XXX: Is this even used anymore? Seems a relic from # Clients like xDavv5 on Android, or Cyberduck, use chunked requests. # When FastCGI or FPM is used with apache, requests arrive to Nextcloud without any content. # This leads to the creation of empty files. # The following directive will force the problematic requests to be buffered before being forwarded to Nextcloud. # This way, the "Transfer-Encoding" header is removed, the "Content-Length" header is set, and the request content is proxied to Nextcloud. # Here are more information about the issue: # - https://docs.cyberduck.io/mountainduck/issues/fastcgi/ # - https://docs.nextcloud.com/server/latest/admin_manual/issues/general_troubleshooting.html#troubleshooting-webdav SetEnvIfNoCase Transfer-Encoding "chunked" proxy-sendcl=1 # Apache disabled the sending of the server-side content-length header # in their 2.4.59 patch updated which breaks some use-cases in Nextcloud. # Setting ap_trust_cgilike_cl allows to bring back the usual behaviour. # See https://bz.apache.org/bugzilla/show_bug.cgi?id=68973 SetEnv ap_trust_cgilike_cl AddDefaultCharset utf-8 Options -Indexes