content-security-policy

Content Security Policy (CSP) header not implemented

cookies

Cookies set without using the Secure flag or set over HTTP

Content is not visible via cross-origin resource sharing (CORS) files or headers

Initial redirection is to HTTPS on same host, final destination is HTTPS

HTTP Strict Transport Security (HSTS) header not implemented

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

X-Content-Type-Options header set to "nosniff"

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

Deprecated X-XSS-Protection header not implemented

Impact	Description	Documentation
-25		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-20		OWASP Session Management Cheat Sheet.
-20		Doc header Strict-Transport-Security (HSTS).