# Enable Rewrite Engine
RewriteEngine On

# Allow from all
Order allow,deny
Allow from all

# Set UTF-8 Encoding
AddDefaultCharset UTF-8

# Enable CORS
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
Header set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"

# Hide PHP extensions
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php [L]

# Security: Deny access to sensitive files
<FilesMatch "^(config|jwt|middleware)\.php$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Security: Deny access to .htaccess
<Files .htaccess>
    Order allow,deny
    Deny from all
</Files>

# Prevent directory listing
Options -Indexes

# Protect against XSS
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
</IfModule>
