content-security-policy

Content Security Policy (CSP) header not implemented

cookies

Cookies set without using the Secure flag, but transmission over HTTP prevented by HSTS

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header not implemented

x-frame-options

X-Frame-Options (XFO) header not implemented

x-xss-protection

Deprecated X-XSS-Protection header not implemented

Diagnostics

Metrics

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

Setting the XSS-Protection header is deprecated. Setting the header to anything other than `0` can actually introduce an XSS vulnerability.

XSS-Protection Header - Cross-Site Scripting

TS010f2491

Current_Session

TYPO3 is a free and open-source Web content management system written in PHP.

TYPO3 CMS

TypeScript is an open-source language which builds on JavaScript  by adding static type definitions.

TypeScript

PHP is a general-purpose scripting language used for web development.

Angular is a TypeScript-based open-source web application framework led by the Angular Team at Google.

Angular

Zone.js

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

Google Font API is a web service that supports open-source font files that can be used on your web designs.

Google Font API

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

reCAPTCHA

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Webpack is an open-source JavaScript module bundler.

Webpack

Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.

Popper

Module Federation is a webpack technology for dynamically loading parts of other independently deployed builds.

Impact	Description	Documentation
-25		Doc Content Security Policy. L'extension github.com/april/laboratory permet de générer la CSP pour votre application.
-20		Doc header X-Frame-Options.
-5		OWASP Session Management Cheat Sheet.
-5		Doc header X-Content-Type-Options.

Séverité	Name	Matcher
info	CAA Record	caa-fingerprint
info	XSS-Protection Header - Cross-Site Scripting	xss-deprecated-header

https://www.telerc.travail.gouv.fr

Mozilla HTTP observatory34 minutes

SSL

Expiration : 30/06/2025

Nuclei33 minutes