DirectorySlash On

# Auth is checked in PHP (index.php), not via Apache AuthUserFile: relative
# AuthUserFile paths resolve against ServerRoot, not this directory, and
# that differs per environment (podman dev container vs cPanel). Some SAPIs
# (LSAPI/CGI/FastCGI, used on cPanel) strip the Authorization header from
# PHP by default, so forward it explicitly via an internal env var.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

<Files ".htpasswd">
    Require all denied
</Files>