norbipeti/HiddenSounds
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

Added header...

Browse source
This commit is contained in:
Norbi Peti 2019-05-13 13:45:10 +02:00
parent 7f7a985344
commit 3b3be820e9
4 changed files with 141 additions and 81 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

152
dist/.htaccess vendored
View file

@ -1,4 +1,4 @@
# Apache Server Configs v3.1.0 | MIT License # Apache Server Configs v3.2.1 | MIT License
# https://github.com/h5bp/server-configs-apache # https://github.com/h5bp/server-configs-apache
# (!) Using `.htaccess` files slows down Apache, therefore, if you have # (!) Using `.htaccess` files slows down Apache, therefore, if you have
@ -126,17 +126,7 @@ Options -MultiViews
# https://msdn.microsoft.com/en-us/library/ff955275.aspx # https://msdn.microsoft.com/en-us/library/ff955275.aspx
<IfModule mod_headers.c> <IfModule mod_headers.c>
Header set X-UA-Compatible "IE=edge" "expr=%{CONTENT_TYPE} =~ m#text/html#i"
Header set X-UA-Compatible "IE=edge"
# `mod_headers` cannot match based on the content-type, however,
# the `X-UA-Compatible` response header should be sent only for
# HTML documents and not for the other resources.
<FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
Header unset X-UA-Compatible
</FilesMatch>
</IfModule> </IfModule>
# ###################################################################### # ######################################################################
@ -160,8 +150,9 @@ Options -MultiViews
AddType application/json json map topojson AddType application/json json map topojson
AddType application/ld+json jsonld AddType application/ld+json jsonld
AddType application/rss+xml rss AddType application/rss+xml rss
AddType application/vnd.geo+json geojson AddType application/geo+json geojson
AddType application/xml rdf xml AddType application/rdf+xml rdf
AddType application/xml xml
# JavaScript # JavaScript
@ -248,26 +239,24 @@ AddDefaultCharset utf-8
# https://httpd.apache.org/docs/current/mod/mod_mime.html#addcharset # https://httpd.apache.org/docs/current/mod/mod_mime.html#addcharset
<IfModule mod_mime.c> <IfModule mod_mime.c>
AddCharset utf-8 .atom \ AddCharset utf-8 .appcache \
.bbaw \ .bbaw \
.css \ .css \
.geojson \ .htc \
.ics \ .ics \
.js \ .js \
.json \ .json \
.jsonld \
.manifest \ .manifest \
.map \
.markdown \ .markdown \
.md \ .md \
.mjs \ .mjs \
.rdf \
.rss \
.topojson \ .topojson \
.vtt \ .vtt \
.webapp \ .vcard \
.vcf \
.webmanifest \ .webmanifest \
.xloc \ .xloc
.xml
</IfModule> </IfModule>
# ###################################################################### # ######################################################################
@ -462,17 +451,7 @@ AddDefaultCharset utf-8
# https://www.owasp.org/index.php/Clickjacking # https://www.owasp.org/index.php/Clickjacking
# <IfModule mod_headers.c> # <IfModule mod_headers.c>
# Header set X-Frame-Options "DENY" "expr=%{CONTENT_TYPE} =~ m#text/html#i"
# Header set X-Frame-Options "DENY"
# # `mod_headers` cannot match based on the content-type, however,
# # the `X-Frame-Options` response header should be sent only for
# # HTML documents and not for the other resources.
# <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
# Header unset X-Frame-Options
# </FilesMatch>
# </IfModule> # </IfModule>
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
@ -485,30 +464,68 @@ AddDefaultCharset utf-8
# This can be done by setting a `Content Security Policy` which # This can be done by setting a `Content Security Policy` which
# whitelists trusted sources of content for your website. # whitelists trusted sources of content for your website.
# #
# The example header below allows ONLY scripts that are loaded from # There is no policy that fits all websites, you will have to modify
# the current website's origin (no inline scripts, no CDN, etc). # the `Content-Security-Policy` directives in the example below depending
# That almost certainly won't work as-is for your website! # on your needs.
# #
# To make things easier, you can use an online CSP header generator # The example policy below aims to:
# such as: https://www.cspisawesome.com/.
# #
# (1) Restrict all fetches by default to the origin of the current website
# by setting the `default-src` directive to `'self'` - which acts as a
# fallback to all "Fetch directives" (https://developer.mozilla.org/en-US/docs/Glossary/Fetch_directive).
#
# This is convenient as you do not have to specify all Fetch directives
# that apply to your site, for example:
# `connect-src 'self'; font-src 'self'; script-src 'self'; style-src 'self'`, etc.
#
# This restriction also means that you must explicitly define from
# which site(s) your website is allowed to load resources from.
#
# (2) The `<base>` element is not allowed on the website. This is to
# prevent attackers from changing the locations of resources loaded
# from relative URLs.
#
# If you want to use the `<base>` element, then `base-uri 'self'`
# can be used instead.
#
# (3) Form submissions are only allowed from the current website by
# setting: `form-action 'self'`.
#
# (4) Prevents all websites (including your own) from embedding your
# webpages within e.g. the `<iframe>` or `<object>` element by
# setting `frame-ancestors 'none'`.
#
# The `frame-ancestors` directive helps avoid "Clickjacking" attacks
# and is similar to the `X-Frame-Options` header.
#
# Browsers that support the CSP header will ignore `X-Frame-Options`
# if `frame-ancestors` is also specified.
#
# (5) Forces the browser to treat all the resources that are served over
# HTTP as if they were loaded securely over HTTPS by setting the
# `upgrade-insecure-requests` directive.
#
# Please note that `upgrade-insecure-requests` does not ensure
# HTTPS for the top-level navigation. If you want to force the
# website itself to be loaded over HTTPS you must include the
# `Strict-Transport-Security` header.
#
# To make your CSP implementation easier, you can use an online CSP header
# generator such as:
# https://report-uri.com/home/generate/
#
# It is encouraged that you validate your CSP header using a CSP validator
# such as:
# https://csp-evaluator.withgoogle.com
#
# https://csp.withgoogle.com/docs/
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
# https://www.w3.org/TR/CSP3/
# https://content-security-policy.com/
# https://www.html5rocks.com/en/tutorials/security/content-security-policy/ # https://www.html5rocks.com/en/tutorials/security/content-security-policy/
# https://www.w3.org/TR/CSP/
# <IfModule mod_headers.c> # <IfModule mod_headers.c>
# # (1) (2) (3) (4) (5)
# Header set Content-Security-Policy "script-src 'self'; object-src 'self'" # Header set Content-Security-Policy "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text/html#i"
# # `mod_headers` cannot match based on the content-type, however,
# # the `Content-Security-Policy` response header should be sent
# # only for HTML documents and not for the other resources.
# <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
# Header unset Content-Security-Policy
# </FilesMatch>
# </IfModule> # </IfModule>
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
@ -679,18 +696,8 @@ AddDefaultCharset utf-8
# https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 # https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
# <IfModule mod_headers.c> # <IfModule mod_headers.c>
# # (1) (2) # # (1) (2)
# Header set X-XSS-Protection "1; mode=block" # Header set X-XSS-Protection "1; mode=block" "expr=%{CONTENT_TYPE} =~ m#text/html#i"
# # `mod_headers` cannot match based on the content-type, however,
# # the `X-XSS-Protection` response header should be sent only for
# # HTML documents and not for the other resources.
# <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
# Header unset X-XSS-Protection
# </FilesMatch>
# </IfModule> # </IfModule>
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
@ -711,23 +718,12 @@ AddDefaultCharset utf-8
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
# <IfModule mod_headers.c> # <IfModule mod_headers.c>
# # no-referrer-when-downgrade (default) # # no-referrer-when-downgrade (default)
# # This should be the user agent's default behavior if no policy is # # This should be the user agent's default behavior if no policy is
# # specified.The origin is sent as referrer to a-priori as-much-secure # # specified.The origin is sent as referrer to a-priori as-much-secure
# # destination (HTTPS->HTTPS), but isn't sent to a less secure destination # # destination (HTTPS->HTTPS), but isn't sent to a less secure destination
# # (HTTPS->HTTP). # # (HTTPS->HTTP).
# Header set Referrer-Policy "no-referrer-when-downgrade" "expr=%{CONTENT_TYPE} =~ m#text/html#i"
# Header set Referrer-Policy "no-referrer-when-downgrade"
# # `mod_headers` cannot match based on the content-type, however,
# # the `Referrer-Policy` response header should be sent
# # only for HTML documents and not for the other resources.
# <FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
# Header unset Referrer-Policy
# </FilesMatch>
# </IfModule> # </IfModule>
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
@ -775,6 +771,7 @@ AddDefaultCharset utf-8
<IfModule mod_headers.c> <IfModule mod_headers.c>
Header unset X-Powered-By Header unset X-Powered-By
Header always unset X-Powered-By
</IfModule> </IfModule>
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
@ -839,7 +836,7 @@ ServerSignature Off
"application/rdf+xml" \ "application/rdf+xml" \
"application/rss+xml" \ "application/rss+xml" \
"application/schema+json" \ "application/schema+json" \
"application/vnd.geo+json" \ "application/geo+json" \
"application/vnd.ms-fontobject" \ "application/vnd.ms-fontobject" \
"application/wasm" \ "application/wasm" \
"application/x-font-ttf" \ "application/x-font-ttf" \
@ -847,15 +844,12 @@ ServerSignature Off
"application/x-web-app-manifest+json" \ "application/x-web-app-manifest+json" \
"application/xhtml+xml" \ "application/xhtml+xml" \
"application/xml" \ "application/xml" \
"font/collection" \
"font/eot" \ "font/eot" \
"font/opentype" \ "font/opentype" \
"font/otf" \ "font/otf" \
"font/ttf" \
"image/bmp" \ "image/bmp" \
"image/svg+xml" \ "image/svg+xml" \
"image/vnd.microsoft.icon" \ "image/vnd.microsoft.icon" \
"image/x-icon" \
"text/cache-manifest" \ "text/cache-manifest" \
"text/calendar" \ "text/calendar" \
"text/css" \ "text/css" \
@ -1082,7 +1076,7 @@ FileETag None
ExpiresByType application/json "access plus 0 seconds" ExpiresByType application/json "access plus 0 seconds"
ExpiresByType application/ld+json "access plus 0 seconds" ExpiresByType application/ld+json "access plus 0 seconds"
ExpiresByType application/schema+json "access plus 0 seconds" ExpiresByType application/schema+json "access plus 0 seconds"
ExpiresByType application/vnd.geo+json "access plus 0 seconds" ExpiresByType application/geo+json "access plus 0 seconds"
ExpiresByType application/xml "access plus 0 seconds" ExpiresByType application/xml "access plus 0 seconds"
ExpiresByType text/calendar "access plus 0 seconds" ExpiresByType text/calendar "access plus 0 seconds"
ExpiresByType text/xml "access plus 0 seconds" ExpiresByType text/xml "access plus 0 seconds"

0
dist/LICENSE.txt → dist/HTML5-Boilerplate-LICENSE.txt vendored
View file

35
dist/index.html vendored
View file

@ -15,6 +15,31 @@
<link rel="stylesheet" href="css/main.css"> <link rel="stylesheet" href="css/main.css">
<meta name="theme-color" content="#fafafa"> <meta name="theme-color" content="#fafafa">
<style>
#popularSongs, #hiddenSongs {
width: 40%;
margin: 4%;
border: 1px #78ffee solid;
}
#popularSongs h2, #hiddenSongs h2 {
text-align: center;
background-image: linear-gradient(to right, transparent, #78ffee, transparent);
}
#popularSongs {
float: left;
}
#hiddenSongs {
float: right;
}
h1 {
text-align: center;
}
</style>
</head> </head>
<body> <body>
@ -23,12 +48,20 @@
<![endif]--> <![endif]-->
<!-- Add your site or application content here --> <!-- Add your site or application content here -->
<p>Hello world! This is HTML5 Boilerplate.</p> <h1>Hidden Sounds Unofficial (Fan) Website</h1>
<div id="popularSongs">
<h2>Popular Songs</h2>
</div>
<div id="hiddenSongs">
<h2>Hidden Songs</h2>
</div>
<!--
<script src="js/vendor/modernizr-3.7.1.min.js"></script> <script src="js/vendor/modernizr-3.7.1.min.js"></script>
<script src="https://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous"></script> <script src="https://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous"></script>
<script>window.jQuery || document.write('<script src="js/vendor/jquery-3.3.1.min.js"><\/script>')</script> <script>window.jQuery || document.write('<script src="js/vendor/jquery-3.3.1.min.js"><\/script>')</script>
<script src="js/plugins.js"></script> <script src="js/plugins.js"></script>
<script src="js/main.js"></script> <script src="js/main.js"></script>
-->
<!-- Google Analytics: change UA-XXXXX-Y to be your site's ID. --> <!-- Google Analytics: change UA-XXXXX-Y to be your site's ID. -->
<script> <script>

35
src/index.html
View file

@ -15,6 +15,31 @@
<link rel="stylesheet" href="css/main.css"> <link rel="stylesheet" href="css/main.css">
<meta name="theme-color" content="#fafafa"> <meta name="theme-color" content="#fafafa">
<style>
#popularSongs, #hiddenSongs {
width: 40%;
margin: 4%;
border: 1px #78ffee solid;
}
#popularSongs h2, #hiddenSongs h2 {
text-align: center;
background-image: linear-gradient(to right, transparent, #78ffee, transparent);
}
#popularSongs {
float: left;
}
#hiddenSongs {
float: right;
}
h1 {
text-align: center;
}
</style>
</head> </head>
<body> <body>
@ -23,12 +48,20 @@
<![endif]--> <![endif]-->
<!-- Add your site or application content here --> <!-- Add your site or application content here -->
<p>Hello world! This is HTML5 Boilerplate.</p> <h1>Hidden Sounds Unofficial (Fan) Website</h1>
<div id="popularSongs">
<h2>Popular Songs</h2>
</div>
<div id="hiddenSongs">
<h2>Hidden Songs</h2>
</div>
<!--
<script src="js/vendor/modernizr-{{MODERNIZR_VERSION}}.min.js"></script> <script src="js/vendor/modernizr-{{MODERNIZR_VERSION}}.min.js"></script>
<script src="https://code.jquery.com/jquery-{{JQUERY_VERSION}}.min.js" integrity="{{JQUERY_SRI_HASH}}" crossorigin="anonymous"></script> <script src="https://code.jquery.com/jquery-{{JQUERY_VERSION}}.min.js" integrity="{{JQUERY_SRI_HASH}}" crossorigin="anonymous"></script>
<script>window.jQuery || document.write('<script src="js/vendor/jquery-{{JQUERY_VERSION}}.min.js"><\/script>')</script> <script>window.jQuery || document.write('<script src="js/vendor/jquery-{{JQUERY_VERSION}}.min.js"><\/script>')</script>
<script src="js/plugins.js"></script> <script src="js/plugins.js"></script>
<script src="js/main.js"></script> <script src="js/main.js"></script>
-->
<!-- Google Analytics: change UA-XXXXX-Y to be your site's ID. --> <!-- Google Analytics: change UA-XXXXX-Y to be your site's ID. -->
<script> <script>