# Security headers
<IfModule mod_headers.c>
  # CSP disabled — framework uses too many third-party services
  # Header set Content-Security-Policy "..."
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  Header set Permissions-Policy "geolocation=(self), camera=(), microphone=(), payment=()"
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine on

  RewriteRule web.config - [F,L]
  RewriteRule ^(.*)(device/[^/]+/)(min/.*)$ $1$3?_device=$2 [QSA,L]
  
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !=min/.*$
  RewriteRule ^(.*)$ index.php?_path=$1 [L,QSA]

  RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
  RewriteRule .* - [F]
</IfModule>
