content-security-policy

Content Security Policy (CSP) implemented without 'unsafe-inline' or 'unsafe-eval'

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header cannot be recognized

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) header not implemented

x-xss-protection

Deprecated X-XSS-Protection header not implemented

default-src 'self'; script-src 'report-sample' 'self'; style-src 'report-sample' 'self' 'sha256-HzhUjVBe6Oi2wcxUM7bmy2Rp9VdLMHYDdYr9MalNmOY='; object-src 'none'; base-uri 'self'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https; manifest-src 'self'; media-src 'self';

Diagnostics

Metrics

http

https

Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.

Node.js

Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.

Express

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

CSP: Wildcard Directive

Missing Anti-clickjacking Header

Permissions Policy Header Not Set

Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)

Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

Base64 Disclosure

Information Disclosure - Suspicious Comments

Modern Web Application

Re-examine Cache-control Directives

Sec-Fetch-Dest Header is Missing

Sec-Fetch-Mode Header is Missing

Sec-Fetch-Site Header is Missing

Sec-Fetch-User Header is Missing

Storable but Non-Cacheable Content

%23%23%20En%20phase%20d%27acc%C3%A9l%C3%A9ration%0A%0A-%20%2A%2AVous%20souhaitez%20d%C3%A9couvrir%20le%20produit%20ou%20un%20accompagnement%20dans%20sa%20prise%20en%20main%20%3F%20%5BContactez%20Antoine%20et%20Henri%20qui%20se%20feront%20un%20plaisir%20de%20vous%20accompagner%5D%28mailto%3Asupport%40monservicesecurise.beta.gouv.fr%29.%2A%2A%0A-%20%2A%2APour%20toute%20autre%20question%20sur%20le%20projet%2C%20propositions%20de%20partenariats%20%5Bcontactez-nous%20%C3%A0%20cette%20adresse%5D%28mailto%3Acontact%40monservicesecurise.beta.gouv.fr%29.%2A%2A%0A-%20%2A%2A%5BAcc%C3%A9der%20%C3%A0%20MonServiceS%C3%A9curis%C3%A9%5D%28https%3A%2F%2Fwww.monservicesecurise.ssi.gouv.fr%29%2A%2A%0A%0A%23%23%20L%27ENJEU%0A%0ALes%20collectivit%C3%A9s%20territoriales%2C%20administrations%20d%27%C3%89tat%2C%20%C3%A9tablissements%20et%0Aautres%20organismes%20publics%20mettent%20%C3%A0%20disposition%20des%20usagers%20de%20plus%20en%20plus%0Ade%20services%20publics%20num%C3%A9riques%20%3A%20m%C3%A9diath%C3%A8que%20permettant%20la%20r%C3%A9servation%20en%0Aligne%20de%20contenus%20multim%C3%A9dias%2C%20caisse%20des%20%C3%A9coles%20permettant%20le%20paiement%20de%20la%0Acantine%2C%20etc.%0A%0APlusieurs%20dizaines%20de%20milliers%20%C3%A0%20l%27%C3%A9chelle%20nationale%2C%0Aces%20services%20num%C3%A9riques%20sont%20r%C3%A9guli%C3%A8rement%20la%20cible%20de%20cyberattaques.%0ARenforcer%20leur%20s%C3%A9curit%C3%A9%20est%2C%20par%20cons%C3%A9quent%2C%0Aessentiel%20afin%20de%20les%20prot%C3%A9ger%20contre%20ces%20menaces.%0A%0AD%C3%A9sireuses%20de%20renforcer%20la%20s%C3%A9curit%C3%A9%20de%20leurs%20services%20num%C3%A9riques%20%28ou%20%C2%AB%20t%C3%A9l%C3%A9services%20%C2%BB%29%0Aet%20d%27homologuer%20leur%20s%C3%A9curit%C3%A9%2C%20conform%C3%A9ment%20%C3%A0%20la%20r%C3%A9glementation%20%28RGS%2C%20d%C3%A9cret%202022-513%2C%20RGPD%29%0Ade%20nombreuses%20entit%C3%A9s%20publiques%20et%20en%20particulier%20des%20collectivit%C3%A9s%2C%20sont%0Aaujourd%27hui%20en%20attente%20de%20davantage%20d%27accompagnement.%0A%0A%23%23%20LA%20SOLUTION%0A%0AMonServiceS%C3%A9curis%C3%A9%20est%20la%20solution%20de%20cybers%C3%A9curit%C3%A9%20de%20l%27ANSSI%0Apour%20aider%20les%20entit%C3%A9s%20publiques%20%C3%A0%20s%C3%A9curiser%20et%20%C3%A0%20homologuer%20rapidement%20leurs%20sites%20web%2C%20applications%20mobiles%20et%20API.%0A%0AGratuit%20et%20collaboratif%2C%20MonServiceS%C3%A9curis%C3%A9%20permet%20de%20r%C3%A9f%C3%A9rencer%20un%20service%20num%C3%A9rique%20en%20projet%2C%20en%20cours%20de%0Ad%C3%A9veloppement%20ou%20d%C3%A9j%C3%A0%20en%20ligne%20puis%20de%20le%20d%C3%A9crire%20en%20%20%3A%0A-%20Acc%C3%A9dant%20%C3%A0%20une%20liste%20personnalis%C3%A9e%20de%20mesures%20de%20s%C3%A9curit%C3%A9%20%C3%A9labor%C3%A9e%20par%20l%27ANSSI%20et%20obtenir%20une%20%C3%A9valuation%0Aindicative%20du%20niveau%20de%20s%C3%A9curit%C3%A9%20du%20service%20concern%C3%A9%20%28l%27indice%20cyber%29%2C%20sur%20la%20base%20des%20mesures%20de%20s%C3%A9curit%C3%A9%20d%C3%A9clar%C3%A9es%0Apar%20l%27%C3%A9quipe%20comme%20ayant%20%C3%A9t%C3%A9%20mises%20en%20%C5%93uvre.%0A-%20G%C3%A9n%C3%A9rant%20en%20quelques%20%C3%A9tapes%20une%20d%C3%A9cision%20d%27homologation%20de%20s%C3%A9curit%C3%A9%20incluant%20un%20ou%20plusieurs%20avis%20des%20membres%0Ade%20l%27%C3%A9quipe%20sur%20le%20projet%20de%20d%C3%A9cision%20d%27homologation%20et%20de%20soumettre%20cette%20d%C3%A9cision%20%C3%A0%20la%20signature%20de%20l%27autorit%C3%A9%20d%27homologation.%0A%0A%5BD%C3%A9couvrir%20MonServiceS%C3%A9curis%C3%A9%5D%28https%3A%2F%2Fwww.monservicesecurise.ssi.gouv.fr%2F%29

MonServiceSécurisé

investigation

construction

acceleration

All cookies use the Secure flag, session cookies use the HttpOnly flag, and cross-origin restrictions are in place via the SameSite flag

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

default-src 'self'; connect-src 'self' https://stats.beta.gouv.fr/matomo.php; img-src 'self' data:; script-src 'self'; frame-src https://metabase.monservicesecurise.ssi.gouv.fr/

sc-sticky-session

bln_challengejs

default-src 'self'; connect-src 'self' https://stats.beta.gouv.fr/matomo.php; img-src 'self' data:; script-src 'self'; frame-src https://metabase.monservicesecurise.cyber.gouv.fr/

Tableau de bord : lab-innov-anssi