RewriteEngine On
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

<IfModule mod_mime.c>
  AddType video/mp4 .mp4
  AddType video/webm .webm
  AddType video/ogg .ogv .ogg
</IfModule>
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

<Files ".env">
  Order allow,deny
  Deny from all
</Files>

<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://s3.tradingview.com https://*.tradingview.com https://*.tradingview-widget.com https://code.jivosite.com; script-src-elem 'self' 'unsafe-inline' https://s3.tradingview.com https://*.tradingview.com https://*.tradingview-widget.com https://code.jivosite.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://s3.tradingview.com https://*.tradingview.com https://*.tradingview-widget.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; frame-src 'self' https://www.tradingview.com https://s.tradingview.com https://*.tradingview.com https://tradingview-widget.com https://*.tradingview-widget.com https://*.jivosite.com; child-src 'self' https://www.tradingview.com https://s.tradingview.com https://*.tradingview.com https://tradingview-widget.com https://*.tradingview-widget.com https://*.jivosite.com; connect-src 'self' https://*.tradingview.com https://*.tradingview-widget.com https://*.jivosite.com wss://*.tradingview.com wss://*.tradingview-widget.com wss://*.jivosite.com;"
  SetEnvIf Request_URI "^/api/" IS_API=1
  Header set Access-Control-Allow-Origin "*" env=IS_API
  Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" env=IS_API
  Header set Access-Control-Allow-Headers "Content-Type, Authorization" env=IS_API
</IfModule>

RewriteRule ^vendor/ - [F,L]
