content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Not able to connect via HTTP, so no redirection necessary

referrer-policy

Referrer-Policy header set to "no-referrer-when-downgrade"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to less than six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

default-src 'self' api-adresse.data.gouv.fr election-tpe.intranet.travail.gouv.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.piste.gouv.fr vqzw.election-tpe.travail.gouv.fr *.googletagmanager.com s2.adform.net connect.facebook.net; connect-src 'self' api-adresse.data.gouv.fr election-tpe-kc.travail.gouv.fr *.googlesyndication.com *.google-analytics.com *.analytics.google.com *.googletagmanager.com *.g.doubleclick.net *.google.com; img-src 'self' data: *.piste.gouv.fr jedonnemonavis.numerique.gouv.fr election-tpe.intranet.travail.gouv.fr vqzw.election-tpe.travail.gouv.fr *.google-analytics.com *.googletagmanager.com ad.doubleclick.net *.googlesyndication.com server.adform.net secure.adnxs.com px.ads.linkedin.com; media-src 'self' data: *.piste.gouv.fr www.youtube.com www.dailymotion.com election-tpe.intranet.travail.gouv.fr; style-src 'self' 'unsafe-inline' *.piste.gouv.fr; frame-src www.youtube.com www.dailymotion.com 3048978.fls.doubleclick.net td.doubleclick.net 3988071.fls.doubleclick.net; base-uri 'self'; form-action 'self'; frame-ancestors https://election-tpe.intranet.travail.gouv.fr;

Diagnostics

Metrics

__Secure-next-auth.callback-url

TS01556c60

__Host-next-auth.csrf-token

_fbp

Drupal is a free and open-source web content management framework.

Drupal

PHP is a general-purpose scripting language used for web development.

Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.

Node.js

React is an open-source JavaScript library for building user interfaces or UI components.

React

Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.

Amazon Web Services

Next.js is a React framework for developing single page Javascript applications.

Next.js

Emotion is a library designed for writing CSS styles with JavaScript.

Emotion

Google Analytics is a free web analytics service that tracks and reports website traffic.

Google Analytics

LinkedIn Insight Tag is a lightweight JavaScript tag that powers conversion tracking, website audiences, and website demographics.

Linkedin Insight Tag

Facebook pixel is an analytics tool that allows you to measure the effectiveness of your advertising.

Facebook Pixel

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

Priority Hints exposes a mechanism for developers to signal a relative priority for browsers to consider when fetching resources.

Priority Hints

AppNexus is a cloud-based software platform that enables and optimizes programmatic online advertising.

AppNexus

Linkedin Ads is a paid marketing tool that offers access to Linkedin social networks through various sponsored posts and other methods.

Linkedin Ads

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Amazon Simple Email Service (SES) is an email service that enables developers to send mail from within any application.

Amazon SES

Webpack is an open-source JavaScript module bundler.

Webpack

Module Federation is a webpack technology for dynamically loading parts of other independently deployed builds.

Impact	Description	Documentation
-20		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-10		Doc header Strict-Transport-Security (HSTS).
-5		Doc Subresource Integrity.

https://election-tpe.travail.gouv.fr

Mozilla HTTP observatoryenviron 5 heures

SSL

Grade capped to A. HSTS max-age is too short

Expiration : 20/09/2025