Options -MultiViews
RewriteEngine On

# Pass the Authorization header through to PHP (many hosts strip it otherwise)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
<IfModule mod_setenvif.c>
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>

# 3.34.0: the settings folder and the API's own files are never opened by a
# browser. The router reads them from disk; asking for them by address is refused.
RewriteRule ^config(/|$) - [F,L]
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^api/.+\.php$ - [F,L]

# Handle OPTIONS preflight
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule .* - [R=200,L]

# Route all requests through index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [QSA,L]

# Security: block direct access to config
<Files "config.php">
    Order Allow,Deny
    Deny from all
</Files>
