mirror of
https://github.com/h5bp/html5-boilerplate.git
synced 2026-01-09 22:58:12 -05:00
Merge pull request #2580 from h5bp/dev/run-build-update
Run build update
This commit is contained in:
Rob Larsen
198
dist/.htaccess
vendored
198
dist/.htaccess
vendored
@@ -1,4 +1,4 @@
|
||||
# Apache Server Configs v4.1.0 | MIT License
|
||||
# Apache Server Configs v5.0.0 | MIT License
|
||||
# https://github.com/h5bp/server-configs-apache
|
||||
|
||||
# (!) Using `.htaccess` files slows down Apache, therefore, if you have
|
||||
@@ -27,9 +27,15 @@
|
||||
# allowing access based on (sub)domain:
|
||||
#
|
||||
# Header set Access-Control-Allow-Origin "subdomain.example.com"
|
||||
#
|
||||
# (1) When `Access-Control-Allow-Origin` points to a specific rule rather
|
||||
# than `*`, then `Vary: Origin` should be sent along with the response.
|
||||
|
||||
# <IfModule mod_headers.c>
|
||||
# Header set Access-Control-Allow-Origin "*"
|
||||
|
||||
# # (1)
|
||||
# # Header append Vary Origin
|
||||
# </IfModule>
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
@@ -43,7 +49,7 @@
|
||||
|
||||
<IfModule mod_setenvif.c>
|
||||
<IfModule mod_headers.c>
|
||||
<FilesMatch "\.(avifs?|bmp|cur|gif|ico|jpe?g|a?png|svgz?|webp)$">
|
||||
<FilesMatch "\.(avifs?|bmp|cur|gif|ico|jpe?g|jxl|a?png|svgz?|webp)$">
|
||||
SetEnvIf Origin ":" IS_CORS
|
||||
Header set Access-Control-Allow-Origin "*" env=IS_CORS
|
||||
</FilesMatch>
|
||||
@@ -109,32 +115,6 @@ ErrorDocument 404 /404.html
|
||||
|
||||
Options -MultiViews
|
||||
|
||||
# ######################################################################
|
||||
# # INTERNET EXPLORER #
|
||||
# ######################################################################
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
# | Document modes |
|
||||
# ----------------------------------------------------------------------
|
||||
|
||||
# Force Internet Explorer 8/9/10 to render pages in the highest mode
|
||||
# available in various cases when it may not.
|
||||
#
|
||||
# https://hsivonen.fi/doctype/#ie8
|
||||
#
|
||||
# (!) Starting with Internet Explorer 11, document modes are deprecated.
|
||||
# If your business still relies on older web apps and services that were
|
||||
# designed for older versions of Internet Explorer, you might want to
|
||||
# consider enabling `Enterprise Mode` throughout your company.
|
||||
#
|
||||
# https://msdn.microsoft.com/en-us/library/ie/bg182625.aspx#docmode
|
||||
# https://blogs.msdn.microsoft.com/ie/2014/04/02/stay-up-to-date-with-enterprise-mode-for-internet-explorer-11/
|
||||
# https://msdn.microsoft.com/en-us/library/ff955275.aspx
|
||||
|
||||
<IfModule mod_headers.c>
|
||||
Header always set X-UA-Compatible "IE=edge" "expr=%{CONTENT_TYPE} =~ m#text/html#i"
|
||||
</IfModule>
|
||||
|
||||
# ######################################################################
|
||||
# # MEDIA TYPES AND CHARACTER ENCODINGS #
|
||||
# ######################################################################
|
||||
@@ -183,6 +163,7 @@ Options -MultiViews
|
||||
AddType image/avif avif
|
||||
AddType image/avif-sequence avifs
|
||||
AddType image/bmp bmp
|
||||
AddType image/jxl jxl
|
||||
AddType image/svg+xml svg svgz
|
||||
AddType image/webp webp
|
||||
AddType video/mp4 f4v f4p m4v mp4
|
||||
@@ -453,8 +434,7 @@ AddDefaultCharset utf-8
|
||||
#
|
||||
# Keep in mind that while you could send the `X-Frame-Options` header for all
|
||||
# of your website's pages, this has the potential downside that it forbids even
|
||||
# non-malicious framing of your content (e.g.: when users visit your website
|
||||
# using a Google Image Search results page).
|
||||
# non-malicious framing of your content.
|
||||
#
|
||||
# Nonetheless, you should ensure that you send the `X-Frame-Options` header for
|
||||
# all pages that allow a user to make a state-changing operation (e.g: pages
|
||||
@@ -465,10 +445,13 @@ AddDefaultCharset utf-8
|
||||
# more than just clickjacking attacks.
|
||||
# https://cure53.de/xfo-clickjacking.pdf.
|
||||
#
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
|
||||
# (!) The `Content-Security-Policy` header has a `frame-ancestors` directive
|
||||
# which obsoletes this header for supporting browsers.
|
||||
#
|
||||
# https://tools.ietf.org/html/rfc7034
|
||||
# https://blogs.msdn.microsoft.com/ieinternals/2010/03/30/combating-clickjacking-with-x-frame-options/
|
||||
# https://www.owasp.org/index.php/Clickjacking
|
||||
# https://owasp.org/www-project-secure-headers/#x-frame-options
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
|
||||
# https://docs.microsoft.com/archive/blogs/ieinternals/combating-clickjacking-with-x-frame-options
|
||||
|
||||
# <IfModule mod_headers.c>
|
||||
# Header always set X-Frame-Options "DENY" "expr=%{CONTENT_TYPE} =~ m#text/html#i"
|
||||
@@ -517,10 +500,17 @@ AddDefaultCharset utf-8
|
||||
# The `frame-ancestors` directive helps avoid "Clickjacking" attacks and
|
||||
# is similar to the `X-Frame-Options` header.
|
||||
#
|
||||
# Browsers that support the CSP header will ignore `X-Frame-Options` if
|
||||
# Browsers that support the CSP header should ignore `X-Frame-Options` if
|
||||
# `frame-ancestors` is also specified.
|
||||
#
|
||||
# (5) Forces the browser to treat all the resources that are served over HTTP
|
||||
# (5) Elements controlled by `object-src` are perhaps coincidentally
|
||||
# considered legacy HTML elements and are not receiving new standardized
|
||||
# features (such as the security attributes `sandbox` or `allow` for
|
||||
# `<iframe>`).
|
||||
# Therefore it is recommended to restrict this fetch-directive (e.g.,
|
||||
# explicitly set `object-src 'none'` if possible).
|
||||
#
|
||||
# (6) Forces the browser to treat all the resources that are served over HTTP
|
||||
# as if they were loaded securely over HTTPS by setting the
|
||||
# `upgrade-insecure-requests` directive.
|
||||
#
|
||||
@@ -529,7 +519,7 @@ AddDefaultCharset utf-8
|
||||
# loaded over HTTPS you must include the `Strict-Transport-Security`
|
||||
# header.
|
||||
#
|
||||
# (6) The `Content-Security-Policy` header is included in all responses
|
||||
# (7) The `Content-Security-Policy` header is included in all responses
|
||||
# that are able to execute scripting. This includes the commonly used
|
||||
# file types: HTML, XML and PDF documents. Although Javascript files
|
||||
# can not execute script in a "browsing context", they are still included
|
||||
@@ -544,14 +534,15 @@ AddDefaultCharset utf-8
|
||||
# such as:
|
||||
# https://csp-evaluator.withgoogle.com
|
||||
#
|
||||
# https://csp.withgoogle.com/docs/
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
||||
# https://www.html5rocks.com/en/tutorials/security/content-security-policy/
|
||||
# https://www.w3.org/TR/CSP/
|
||||
# https://owasp.org/www-project-secure-headers/#content-security-policy
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
||||
# https://developers.google.com/web/fundamentals/security/csp
|
||||
# https://content-security-policy.com/
|
||||
|
||||
# <IfModule mod_headers.c>
|
||||
# # (1) (2) (3) (4) (5) (6)
|
||||
# Header always set Content-Security-Policy "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
|
||||
# # (1) (2) (3) (4) (5) (6) (7)
|
||||
# Header always set Content-Security-Policy "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
|
||||
# </IfModule>
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
@@ -644,9 +635,9 @@ AddDefaultCharset utf-8
|
||||
# https://hstspreload.org/#deployment-recommendations
|
||||
#
|
||||
# https://tools.ietf.org/html/rfc6797#section-6.1
|
||||
# https://owasp.org/www-project-secure-headers/#http-strict-transport-security
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
|
||||
# https://www.html5rocks.com/en/tutorials/security/transport-layer-security/
|
||||
# https://blogs.msdn.microsoft.com/ieinternals/2014/08/18/strict-transport-security/
|
||||
# https://hstspreload.org/
|
||||
|
||||
# <IfModule mod_headers.c>
|
||||
@@ -666,6 +657,7 @@ AddDefaultCharset utf-8
|
||||
# user-uploaded content or content that could potentially be treated as
|
||||
# executable by the browser.
|
||||
#
|
||||
# https://owasp.org/www-project-secure-headers/#x-content-type-options
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
|
||||
# https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/
|
||||
# https://mimesniff.spec.whatwg.org/
|
||||
@@ -674,48 +666,6 @@ AddDefaultCharset utf-8
|
||||
Header always set X-Content-Type-Options "nosniff"
|
||||
</IfModule>
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
# | Cross-Site Scripting (XSS) Protection |
|
||||
# ----------------------------------------------------------------------
|
||||
|
||||
# Protect website reflected Cross-Site Scripting (XSS) attacks.
|
||||
#
|
||||
# (1) Try to re-enable the cross-site scripting (XSS) filter built into most
|
||||
# web browsers.
|
||||
#
|
||||
# The filter is usually enabled by default, but in some cases, it may be
|
||||
# disabled by the user. However, in Internet Explorer, for example, it can
|
||||
# be re-enabled just by sending the `X-XSS-Protection` header with the
|
||||
# value of `1`.
|
||||
#
|
||||
# (2) Prevent web browsers from rendering the web page if a potential reflected
|
||||
# (a.k.a non-persistent) XSS attack is detected by the filter.
|
||||
#
|
||||
# By default, if the filter is enabled and browsers detect a reflected XSS
|
||||
# attack, they will attempt to block the attack by making the smallest
|
||||
# possible modifications to the returned web page.
|
||||
#
|
||||
# Unfortunately, in some browsers (e.g.: Internet Explorer), this default
|
||||
# behavior may allow the XSS filter to be exploited. Therefore, it's better
|
||||
# to inform browsers to prevent the rendering of the page altogether,
|
||||
# instead of attempting to modify it.
|
||||
#
|
||||
# https://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities
|
||||
#
|
||||
# (!) Do not rely on the XSS filter to prevent XSS attacks! Ensure that you are
|
||||
# taking all possible measures to prevent XSS attacks, the most obvious
|
||||
# being: validating and sanitizing your website's inputs.
|
||||
#
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
|
||||
# https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-iv-the-xss-filter/
|
||||
# https://blogs.msdn.microsoft.com/ieinternals/2011/01/31/controlling-the-xss-filter/
|
||||
# https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
|
||||
|
||||
# <IfModule mod_headers.c>
|
||||
# # (1) (2)
|
||||
# Header always set X-XSS-Protection "1; mode=block" "expr=%{CONTENT_TYPE} =~ m#text/html#i"
|
||||
# </IfModule>
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
# | Referrer Policy |
|
||||
# ----------------------------------------------------------------------
|
||||
@@ -735,14 +685,89 @@ AddDefaultCharset utf-8
|
||||
# https://securityheaders.com/
|
||||
# https://observatory.mozilla.org/
|
||||
#
|
||||
# https://scotthelme.co.uk/a-new-security-header-referrer-policy/
|
||||
# https://www.w3.org/TR/referrer-policy/
|
||||
# https://owasp.org/www-project-secure-headers/#referrer-policy
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
|
||||
# https://scotthelme.co.uk/a-new-security-header-referrer-policy/
|
||||
|
||||
# <IfModule mod_headers.c>
|
||||
# # (1)
|
||||
# Header always set Referrer-Policy "strict-origin-when-cross-origin" "expr=%{CONTENT_TYPE} =~ m#text\/(css|html|javascript)|application\/pdf|xml#i"
|
||||
# </IfModule>
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
# | Cross Origin Policy |
|
||||
# ----------------------------------------------------------------------
|
||||
|
||||
# Set strict a Cross Origin Policy to mitigate information leakage.
|
||||
#
|
||||
# (1) Cross-Origin-Embedder-Policy prevents a document from loading any
|
||||
# cross-origin resources that don’t explicitly grant the document
|
||||
# permission.
|
||||
# https://html.spec.whatwg.org/multipage/origin.html#coep
|
||||
# https://owasp.org/www-project-secure-headers/#cross-origin-embedder-policy
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
|
||||
#
|
||||
# (2) Cross-Origin-Opener-Policy allows you to ensure a top-level document does
|
||||
# not share a browsing context group with cross-origin documents.
|
||||
# https://html.spec.whatwg.org/multipage/origin.html#cross-origin-opener-policies
|
||||
# https://owasp.org/www-project-secure-headers/#cross-origin-opener-policy
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy
|
||||
#
|
||||
# (3) Cross-Origin-Resource-Policy allows to define a policy that lets web
|
||||
# sites and applications opt in to protection against certain requests from
|
||||
# other origins, to mitigate speculative side-channel attacks.
|
||||
# https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header
|
||||
# https://owasp.org/www-project-secure-headers/#cross-origin-resource-policy
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy
|
||||
# https://resourcepolicy.fyi/
|
||||
#
|
||||
# To check your Cross Origin Policy, you can use an online service, such as:
|
||||
# https://securityheaders.com/
|
||||
# https://observatory.mozilla.org/
|
||||
#
|
||||
# https://web.dev/coop-coep/
|
||||
# https://web.dev/why-coop-coep/
|
||||
# https://web.dev/cross-origin-isolation-guide/
|
||||
# https://scotthelme.co.uk/coop-and-coep/
|
||||
|
||||
# <IfModule mod_headers.c>
|
||||
# # (1)
|
||||
# Header always set Cross-Origin-Embedder-Policy "require-corp" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
|
||||
|
||||
# # (2)
|
||||
# Header always set Cross-Origin-Opener-Policy "same-origin" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
|
||||
|
||||
# # (3)
|
||||
# Header always set Cross-Origin-Resource-Policy "same-origin" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
|
||||
# </IfModule>
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
# | Permissions Policy |
|
||||
# ----------------------------------------------------------------------
|
||||
|
||||
# Set a strict Permissions Policy to mitigate access to browser features.
|
||||
#
|
||||
# The header uses a structured syntax, and allows sites to more tightly
|
||||
# restrict which origins can be granted access to features.
|
||||
# The list of available features: https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md
|
||||
#
|
||||
# The example policy below aims to disable all features expect synchronous
|
||||
# `XMLHttpRequest` requests on the same origin.
|
||||
#
|
||||
# To check your Permissions Policy, you can use an online service, such as:
|
||||
# https://securityheaders.com/
|
||||
# https://observatory.mozilla.org/
|
||||
#
|
||||
# https://www.w3.org/TR/permissions-policy-1/
|
||||
# https://owasp.org/www-project-secure-headers/#permissions-policy
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
|
||||
# https://scotthelme.co.uk/a-new-security-header-feature-policy/
|
||||
|
||||
# <IfModule mod_headers.c>
|
||||
# Header always set Permissions-Policy "accelerometer=(),autoplay=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
|
||||
# </IfModule>
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
# | Disable TRACE HTTP Method |
|
||||
# ----------------------------------------------------------------------
|
||||
@@ -1138,6 +1163,7 @@ FileETag None
|
||||
ExpiresByType image/bmp "access plus 1 month"
|
||||
ExpiresByType image/gif "access plus 1 month"
|
||||
ExpiresByType image/jpeg "access plus 1 month"
|
||||
ExpiresByType image/jxl "access plus 1 month"
|
||||
ExpiresByType image/png "access plus 1 month"
|
||||
ExpiresByType image/svg+xml "access plus 1 month"
|
||||
ExpiresByType image/webp "access plus 1 month"
|
||||
@@ -1230,6 +1256,6 @@ FileETag None
|
||||
# <IfModule mod_rewrite.c>
|
||||
# RewriteEngine On
|
||||
# RewriteCond %{REQUEST_FILENAME} !-f
|
||||
# RewriteRule ^(.+)\.(\w+)\.(avifs?|bmp|css|cur|gif|ico|jpe?g|m?js|a?png|svgz?|webp|webmanifest)$ $1.$3 [L]
|
||||
# RewriteRule ^(.+)\.(\w+)\.(avifs?|bmp|css|cur|gif|ico|jpe?g|jxl|m?js|a?png|svgz?|webp|webmanifest)$ $1.$3 [L]
|
||||
# </IfModule>
|
||||
|
||||
|
||||
6
dist/package-lock.json
generated
vendored
6
dist/package-lock.json
generated
vendored
@@ -4885,9 +4885,9 @@
|
||||
"dev": true
|
||||
},
|
||||
"path-parse": {
|
||||
"version": "1.0.6",
|
||||
"resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz",
|
||||
"integrity": "sha512-GSmOT2EbHrINBf9SR7CDELwlJ8AENk3Qn7OikK4nFYAu3Ote2+JYNVvkpAEQm3/TLNEJFD/xZJjzyxg3KBWOzw==",
|
||||
"version": "1.0.7",
|
||||
"resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
|
||||
"integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
|
||||
"dev": true
|
||||
},
|
||||
"pbkdf2": {
|
||||
|
||||
@@ -59,7 +59,7 @@ There are a few different options that you can use with the
|
||||
[`viewport` meta tag](https://docs.google.com/present/view?id=dkx3qtm_22dxsrgcf4
|
||||
"Viewport and Media Queries - The Complete Idiot's Guide").
|
||||
You can find out more in [
|
||||
the MDN Web Docs](https://developer.mozilla.org/en-US/docs/Mozilla/Mobile/Viewport_meta_tag).
|
||||
the MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/HTML/Viewport_meta_tag).
|
||||
HTML5 Boilerplate comes with a simple setup that strikes a good balance for general use cases.
|
||||
|
||||
```html
|
||||
|
||||
Reference in New Issue
Block a user