.htaccess

# Ensure that the site uses HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Remove index.php from the URL
RewriteCond %{REQUEST_URI} !^/index\.php

# Handle requests that are not actual files or directories
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

# Redirect to index.php with the path as a query string
RewriteRule ^(.*)$ /index.php?$1 [L,QSA]

# Set Expires headers for different file types
<IfModule mod_expires.c>
    ExpiresActive On

    # Static images can be cached for a long time
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"

    # Disable caching for JavaScript and HTML files
    ExpiresByType text/javascript "access plus 0 seconds"
    ExpiresByType application/javascript "access plus 0 seconds"
    ExpiresByType text/css "access plus 0 seconds"
    ExpiresByType text/html "access plus 0 seconds"
</IfModule>

# Set Cache-Control headers to disable caching for JavaScript, CSS, and HTML
<IfModule mod_headers.c>
    # Disable caching for JavaScript files
    <FilesMatch "\.(js)$">
        Header set Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate"
        Header set Pragma "no-cache"
        Header set Expires 0
    </FilesMatch>

    # Disable caching for CSS files
    <FilesMatch "\.(css)$">
        Header set Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate"
        Header set Pragma "no-cache"
        Header set Expires 0
    </FilesMatch>

    # Disable caching for HTML files
    <FilesMatch "\.(html|htm)$">
        Header set Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate"
        Header set Pragma "no-cache"
        Header set Expires 0
    </FilesMatch>

    # Add SameSite=None to all cookies (to support cross-origin cookies)
    Header always edit Set-Cookie "(.*)" "$1; SameSite=None; Secure"

    # CORS headers
    Header set Access-Control-Allow-Origin "*"
    Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
    Header set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"

    # Security headers
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# Set Token Environment Variable (for authentication)
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1