content-security-policy

Content Security Policy (CSP) implemented with unsafe sources inside style-src. This includes 'unsafe-inline', data: or overly broad sources such as https:.

cookies

Cookies set without using the Secure flag, but transmission over HTTP prevented by HSTS

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

x-xss-protection

Deprecated X-XSS-Protection header set to "0" (disabled)

default-src 'self' 'nonce-dsfr-index' 'nonce-javascript-index' 'nonce-roboto-index' 'nonce-icons-index' 'nonce-fontsgstatic'; object-src 'none';img-src 'self' data:; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' data: fonts.gstatic.com; connect-src 'self' https://api-adresse.data.gouv.fr/ https://geo.api.gouv.fr/ https://agadir-app.rct01.kleegroup.com/ https://*.auth.integ-app.daccord-ssg.net https://*.auth.valid-app.daccord-ssg.net; script-src 'self' 'nonce-dsfr-index' 'nonce-javascript-index' 'nonce-roboto-index' 'nonce-icons-index' 'nonce-fontsgstatic'

Impact	Description	Documentation
-5		OWASP Session Management Cheat Sheet.

https://www.teleaccords.travail-emploi.gouv.fr

Mozilla HTTP observatory38 minutes

SSL

Grade capped to A. HSTS is not offered

Expiration : 29/10/2024