content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Not able to connect via HTTP, so no redirection necessary

referrer-policy

Referrer-Policy header set to "no-referrer-when-downgrade"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to less than six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

default-src 'self' api-adresse.data.gouv.fr election-tpe.intranet.travail.gouv.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.piste.gouv.fr vqzw.election-tpe.travail.gouv.fr *.googletagmanager.com; connect-src 'self' api-adresse.data.gouv.fr auth.tpe.prd-evote-tnp.fr *.googlesyndication.com *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.google.com; img-src 'self' data: *.piste.gouv.fr jedonnemonavis.numerique.gouv.fr election-tpe.intranet.travail.gouv.fr vqzw.election-tpe.travail.gouv.fr *.google-analytics.com *.googletagmanager.com ad.doubleclick.net; media-src 'self' data: *.piste.gouv.fr www.youtube.com www.dailymotion.com election-tpe.intranet.travail.gouv.fr; style-src 'self' 'unsafe-inline' *.piste.gouv.fr; frame-src www.youtube.com www.dailymotion.com 3048978.fls.doubleclick.net td.doubleclick.net; base-uri 'self'; form-action 'self'; frame-ancestors https://election-tpe.intranet.travail.gouv.fr;

Diagnostics

Metrics

TS01556c60

__Host-next-auth.csrf-token

__Secure-next-auth.callback-url

Drupal is a free and open-source web content management framework.

Drupal

PHP is a general-purpose scripting language used for web development.

Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.

Node.js

React is an open-source JavaScript library for building user interfaces or UI components.

React

Next.js is a React framework for developing single page Javascript applications.

Next.js

Emotion is a library designed for writing CSS styles with JavaScript.

Emotion

Google Analytics is a free web analytics service that tracks and reports website traffic.

Google Analytics

Priority Hints exposes a mechanism for developers to signal a relative priority for browsers to consider when fetching resources.

Priority Hints

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Webpack is an open-source JavaScript module bundler.

Webpack

Module Federation is a webpack technology for dynamically loading parts of other independently deployed builds.

name	domain	httpOnly	secure
TS01556c60	election-tpe.travail.gouv.fr	❌	❌
__Host-next-auth.csrf-token	election-tpe.travail.gouv.fr	✔️	✔️
__Secure-next-auth.callback-url	election-tpe.travail.gouv.fr	✔️	✔️

type	url	details
google tag manager	www.googletagmanager.com/...	Use hosted Matomo instance
unknown	pagead2.googlesyndication...

flag	country	hostname	ip	city
	France	election-tpe.travail.gouv.fr	176.31.133.214	?
	États Unis	www.googletagmanager.com	142.250.190.8	?
	États Unis	pagead2.googlesyndication.com	142.250.190.98	?

https://election-tpe.travail.gouv.fr

LightHouse

https://election-tpe.travail.gouv.fr/environ 4 heures

Cookiesenviron 4 heures

Scripts tiersenviron 4 heures

Déclaration de mise en accessibilité

non-conforme