content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

All cookies use the Secure flag and all session cookies use the HttpOnly flag

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

x-xss-protection

Deprecated X-XSS-Protection header set to "0" (disabled)

img-src 'self' data: blob: *.openstreetmap.org *.cloud.ovh.net *; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.crisp.chat crisp.chat cdn.jsdelivr.net maxcdn.bootstrapcdn.com code.jquery.com unpkg.com; style-src 'self' 'unsafe-inline' *.crisp.chat crisp.chat cdn.jsdelivr.net maxcdn.bootstrapcdn.com unpkg.com; connect-src 'self' wss://*.crisp.chat *.crisp.chat in-automate.sendinblue.com app.franceconnect.gouv.fr sentry.io openmaptiles.geo.data.gouv.fr openmaptiles.github.io tiles.geo.api.gouv.fr wxs.ign.fr  *.cegedim.cloud *.fabrique.social.gouv.fr demat.social.gouv.fr sentry.fabrique.social.gouv.fr api-adresse.data.gouv.fr data.education.gouv.fr geo.api.gouv.fr arssante.opendatasoft.com; frame-src 'self'; default-src 'self' data: blob: 'report-sample' fonts.gstatic.com in-automate.sendinblue.com player.vimeo.com app.franceconnect.gouv.fr *.crisp.chat crisp.chat *.crisp.help *.sibautomation.com sibautomation.com data sentry.fabrique.social.gouv.fr

Diagnostics

Metrics

BIGipServerpool-dgos-dds-prod.cegedim.cloud-TCP3000

_DS_session

_csrf_token

Sentry is an open-source platform for workflow productivity, aggregating errors from across the stack in real time.

Sentry

Ruby is an open-source object-oriented programming language.

Ruby

Ruby on Rails is a server-side web application framework written in Ruby under the MIT License.

Ruby on Rails

A modest JavaScript framework for the HTML you already have.

Stimulus

Turbo is a JavaScript framework for building fast web applications.

Turbo

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Vite is a rapid development tool for modern web projects.

name	domain	httpOnly	secure
BIGipServerpool-dgos-dds-prod.cegedim.cloud-TCP3000	demat.social.gouv.fr	✔️	✔️
_DS_session	demat.social.gouv.fr	✔️	✔️
_csrf_token	demat.social.gouv.fr	✔️	✔️

flag	country	hostname	ip	city
	France	demat.social.gouv.fr	185.194.82.212	?

https://demat.social.gouv.fr

LightHouse

https://demat.social.gouv.fr/environ 5 heures

Cookiesenviron 5 heures

Scripts tiersenviron 5 heures

Déclaration de mise en accessibilité

Conformité partielle