content-security-policy

Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src.

cookies

All cookies use the Secure flag and all session cookies use the HttpOnly flag

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

Deprecated X-XSS-Protection header set to "1; mode=block"

default-src 'none';script-src * 'self' 'nonce-tD9uZlTaoJJX69ZvtFOaHKRg87Y6umV6onDS1IWjIt0=';style-src 'self' 'unsafe-inline';connect-src 'self';form-action 'self';img-src * 'self';frame-ancestors 'none';frame-src 'none';base-uri 'self'

Diagnostics

Metrics

BWROUTEID

.AspNetCore.Antiforgery.O33mliWV2hE

default-src 'none';script-src * 'self' 'nonce-ZpcPrAqwUmcuM03BygFo8M64F2du6h/Y5QM8mZAJ/Rg=';style-src 'self' 'unsafe-inline';connect-src 'self';form-action 'self';img-src * 'self';frame-ancestors 'none';frame-src 'none';base-uri 'self'

Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.

Bootstrap

ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.

Microsoft ASP.NET

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

name	domain	httpOnly	secure
BWROUTEID	rappel.conso.gouv.fr	❌	✔️
.AspNetCore.Antiforgery.O33mliWV2hE	rappel.conso.gouv.fr	✔️	✔️

flag	country	hostname	ip	city
	France	rappel.conso.gouv.fr	185.24.187.242	Paris

https://rappel.conso.gouv.fr

LightHouse

https://rappel.conso.gouv.fr/environ 2 heures

Cookiesenviron 2 heures

Scripts tiersenviron 2 heures

Déclaration de mise en accessibilité