# Block direct browsing of config, lib, and the JWKS cache.
<FilesMatch "^(config|lib)\.php$|^jwks-cache\.json$">
    Require all denied
</FilesMatch>
# Pass the Authorization header through to PHP on CGI/FastCGI hosts.
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
