From 7dfcf5afad5af2ecbfc1331705a585f7ecb21740 Mon Sep 17 00:00:00 2001
From: Josh <josh.t.richards@gmail.com>
Date: Wed, 11 Mar 2026 10:57:53 -0400
Subject: [PATCH] chore(.htaccess): drop no-op QSA flag from RewriteRules

- For Apache `RewriteRule`, if the substitution (right side) has no `?` query part, the original query string is already preserved by default.
- So `QSA` adds nothing in these rules.

Note for the future: QSA will be needed if we ever add a query string on the right (substitution) side. We don't currently so this is just noise in the htaccess rules.

Signed-off-by: Josh <josh.t.richards@gmail.com>
---
 .htaccess | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.htaccess b/.htaccess
index db4f32a1fbb..32060738ab1 100644
--- a/.htaccess
+++ b/.htaccess
@@ -129,11 +129,10 @@
 ## Rule: Map /remote* --> /remote.php* including the query string
 ##
 ## Context:
-##    - XXX: `QSA` seems unnecessary (no-op) here (query string is passed by default when the replacement URI doesn't contain a query string)
 ##    - XXX: Is this even used anymore? Seems a relic from <NC12
 ##
 
-    RewriteRule ^remote/(.*) remote.php [QSA,L]
+    RewriteRule ^remote/(.*) remote.php [L]
 
 ##
 ## Rule: Prevent access to non-public files
@@ -148,21 +147,19 @@
 ##    - Intentionally excludes URIs used for HTTPS certificate verifications
 ##        - RFC 8555 / ACME HTTP Challenges (acme-challenge) 
 ##        - File-based Validations (pki-validation)
-##    - XXX: `QSA` seems unnecessary (no-op) here (query string is passed by default when the replacement URI doesn't contain a query string)
 ##    - XXX: Sometimes we are using `/index.php` and other times `index.php` as our replacement URI; this may be incorrect
 ##
 
-    RewriteRule ^\.well-known/(?!acme-challenge|pki-validation) /index.php [QSA,L]
+    RewriteRule ^\.well-known/(?!acme-challenge|pki-validation) /index.php [L]
 
 ##
 ## Rule: Map the ocm-provider handling to our main frontend controller (/index.php)
 ##
 ## Context:
-##    - XXX: `QSA` seems unnecessary (no-op) here (query string is passed by default when the replacement URI doesn't contain a query string)
 ##    - XXX: Sometimes we are using `/index.php` and other times `index.php` as our replacement URI; this may be incorrect
 ##
 
-    RewriteRule ^ocm-provider/?$ index.php [QSA,L]
+    RewriteRule ^ocm-provider/?$ index.php [L]
 
 ##
 ## Rule: Prevent access to more non-public files