%23%23%20Le%20probl%C3%A8me%0A%0APour%20pr%C3%A8s%20de%2035%20000%20communes%20et%201%20260%20regroupements%20de%20communes%20fran%C3%A7aises%2C%20acc%C3%A9der%20%C3%A0%20des%20aides%20en%20financement%20et%20en%20accompagnement%20est%20essentiel%2C%20car%20sans%20aide%2C%20il%20n%E2%80%99y%20a%20pas%20de%20projets%20d%E2%80%99am%C3%A9nagement%20de%20territoire.%20C%E2%80%99est%20surtout%20un%20v%C3%A9ritable%20casse-t%C3%AAte%20en%20raison%20de%20la%20myriade%20d%E2%80%99aides%20disponibles%2C%20puisqu%E2%80%99on%20en%20recense%20plus%20de%20300%20types%2C%20qui%20rel%C3%A8vent%20de%20diff%C3%A9rents%20niveaux%2C%20r%C3%A9gional%2C%20national%2C%20et%20m%C3%AAme%20europ%C3%A9en%20%3A%20comment%20s%E2%80%99y%20retrouver%20dans%20ce%20maquis%20%3F%0A%0ADes%20dispositifs%20de%20veille%20existent%2C%20mais%20ils%20sont%20le%20plus%20souvent%20construits%20de%20mani%C3%A8re%20individuelle%2C%20avec%20des%20outils%20peu%20collaboratifs%20et%20%C3%A0%20la%20visibilit%C3%A9%20limit%C3%A9e%20%28tableur%2C%20liste%20de%20diffusion%2C%20etc%29.%20Ensuite%2C%20il%20faut%20%C3%AAtre%20en%20mesure%20de%20s%C3%A9lectionner%20les%20aides%20les%20plus%20adapt%C3%A9es%20%C3%A0%20son%20projet%20et%20de%20compl%C3%A9ter%20les%20dossiers%20de%20candidature%20ad%20hoc.%20Des%20chefs%20de%20projets%20peuvent%20ainsi%20passer%20plus%20de%20deux%20tiers%20de%20leur%20temps%20%C3%A0%20rechercher%20ces%20fameuses%20aides%E2%80%A6%20alors%20qu%E2%80%99ils%20pourraient%20consacrer%20ce%20temps%20au%20projet%20en%20lui-m%C3%AAme%20%21%0A%0ACeci%20engendre%20des%20situations%20aberrantes%2C%20avec%20des%20doutes%20sur%20l%E2%80%99apport%20r%C3%A9el%20de%20ces%20dispositifs%20%3A%20frustration%20du%20c%C3%B4t%C3%A9%20des%20financeurs%20qui%20n%E2%80%99atteindront%20pas%20leur%20c%C5%93ur%20de%20cible%2C%20et%20lassitude%20des%20collectivit%C3%A9s%2C%20n%E2%80%99ayant%20aucune%20garantie%20quand%20elles%20remplissent%20un%20dossier%2C%20si%20elles%20arrivent%20%C3%A0%20cette%20%C3%A9tape.%0A%0ALe%20travail%20de%20recherche%20d%27aides%2C%20excessivement%20chronophage%2C%20est%20susceptible%20d%E2%80%99accentuer%20les%20in%C3%A9galit%C3%A9s%20entre%20les%20collectivit%C3%A9s%20%3A%20dans%20le%20meilleur%20des%20cas%2C%20elles%20vont%20d%C3%A9dier%20des%20fiches%20de%20poste%20%C3%A0%20ce%20duo%20%C2%AB%20veille-candidature%20%C2%BB%2C%20dans%20le%20pire%20des%20cas%2C%20elles%20renonceront%20%C3%A0%20certaines%20aides%20par%20m%C3%A9connaissance%20ou%20manque%20de%20temps.%20Les%20aides%20ne%20b%C3%A9n%C3%A9ficient%20alors%20qu%27%C3%A0%20celles%20qui%20peuvent%20consacrer%20des%20moyens%20importants%20au%20travail%20de%20veille%2C%20ce%20qui%20renforce%20la%20fracture%20territoriale%20fran%C3%A7aise.%0A%0A%23%23%20Le%20produit%20%3A%20Aides-territoires%0A%0AAides-territoires%20est%20le%20guichet%20unique%20des%20aides%20qui%20rend%20visibles%20et%20lisibles%20tous%20les%20dispositifs%20%C3%A0%20destination%20des%20collectivit%C3%A9s.%20Il%20permet%20%C3%A0%20chaque%20agent%20et%20%C3%A9lu%20local%20d%E2%80%99identifier%20rapidement%20les%20aides%20pertinentes%20en%20effectuant%20une%20recherche%20territorialis%C3%A9e%2C%20sp%C3%A9cifique%20%C3%A0%20sa%20structure%20et%20aux%20th%C3%A9matiques%20de%20son%20projet.%20La%20veille%20est%20%C3%A9galement%20automatisable%20via%20un%20syst%C3%A8me%20d%E2%80%99alertes%20email.%0A%0APour%20les%20porteurs%20d%E2%80%99aides%2C%20Aides-territoires%20offre%20une%20solution%20cl%C3%A9%20en%20main%20qui%20leur%20permet%20d%E2%80%99ajouter%20des%20dispositifs%2C%20soit%20manuellement%20depuis%20un%20espace%20contributeur%2C%20soit%20via%20un%20flux%20de%20donn%C3%A9es%20%28API%29.%20La%20plateforme%20permet%20de%20d%C3%A9finir%20de%20mani%C3%A8re%20tr%C3%A8s%20granulaire%20la%20cible%20des%20dispositifs%2C%20et%20offre%20%C3%A0%20chaque%20organisme%20porteur%20d%E2%80%99aides%20une%20vitrine%20personnalis%C3%A9e%20et%20des%20indicateurs%20de%20visibilit%C3%A9.%0A%0AAides-territoires%20%C3%A9vite%20le%20re-d%C3%A9veloppement%20de%20plateformes%20par%20chaque%20porteur%20d%E2%80%99aides%20et%20donne%20%C3%A0%20toutes%20les%20collectivit%C3%A9s%20un%20moyen%20efficace%20et%20centralis%C3%A9%20de%20trouver%20les%20aides%20pour%20r%C3%A9aliser%20leurs%20projets.%0A%0A%23%23%20Les%20premi%C3%A8res%20%C3%A9tapes%0A%0ASi%20l%E2%80%99outil%20a%20d%27abord%20concern%C3%A9%2C%20dans%20un%20premier%20temps%2C%20les%20aides%20relatives%20au%20d%C3%A9veloppement%20et%20%C3%A0%20l%27am%C3%A9nagement%20durable%20dans%20leurs%20diverses%20composantes%2C%20aujourd%27hui%2C%20Aides-territoires%20r%C3%A9pertorie%20les%20aides%20pour%20toutes%20les%20th%C3%A9matiques%20de%20projets%20locaux%20%28transition%20%C3%A9nerg%C3%A9tique%2C%20d%C3%A9veloppement%20%C3%A9conomique%2C%20mobilit%C3%A9%2C%20etc.%29.%20De%20m%C3%AAme%2C%20la%20plateforme%20couvre%20tous%20les%20territoires%20fran%C3%A7ais%2C%20en%20m%C3%A9tropole%20comme%20en%20outre-mer.%0A%0AAides-territoires%20suit%20une%20logique%20de%20%22place%20de%20march%C3%A9%22%20structur%C3%A9e%20selon%20deux%20profils%20d%27utilisateurs%20%3A%0A%0A%2A%20L%E2%80%99offre%20%28financements%2C%20aides%20en%20ing%C3%A9nierie%2C%20appels%20%C3%A0%20projets%29%20%C3%A9mane%20de%20nombreux%20acteurs%20%3A%20les%20directions%20g%C3%A9n%C3%A9rales%20des%20minist%C3%A8res%20%28notamment%20Coh%C3%A9sion%20des%20Territoires%20et%20Transition%20%C3%A9cologique%20et%20solidaire%29%20%3B%20les%20agences%20plac%C3%A9es%20sous%20la%20tutelle%20de%20l%27%C3%89tat%20%28Agence%20De%20l%E2%80%99Environnement%20et%20de%20la%20Ma%C3%AEtrise%20de%20l%E2%80%99%C3%89nergie%2C%20Banque%20des%20territoires%2C%20Office%20Fran%C3%A7ais%20pour%20la%20Biodiversit%C3%A9%2C%20Agence%20fran%C3%A7aise%20de%20d%C3%A9veloppement%29%20%3B%20les%20collectivit%C3%A9s%20territoriales%20porteuses%20d%27aides%20%28Conseils%20r%C3%A9gionaux%20et%20d%C3%A9partementaux%2C%20parcs%20naturels%20r%C3%A9gionaux%2C%20p%C3%B4les%20d%27%C3%A9quilibre%20territoriaux%29%20%3B%20les%20structures%20locales%20de%20l%27ing%C3%A9nierie%20%28Directions%20d%C3%A9partementales%20des%20territoires%2C%20Conseils%20d%27Architecture%2C%20d%27Urbanisme%20et%20de%20l%27%E2%80%8BEnvironnement%29%20%3B%20etc.%0A%2A%20La%20demande%20vient%20des%20collectivit%C3%A9s%20et%20plus%20particuli%C3%A8rement%20des%20agents%20en%20charge%20de%20la%20veille%20sur%20les%20aides%20mais%20%C3%A9galement%20de%20leurs%20partenaires%20locaux%20%28associations%2C%20%C3%A9tablissements%20publics%29%20et%20de%20structures%20accompagnantes%20%28DDT%2C%20PETR%2C%20etc.%29%0A%0A%23%23%20Les%20perspectives%0A%0AL%E2%80%99objectif%20est%20de%20consolider%20la%20base%20de%20donn%C3%A9es%20des%20aides%20europ%C3%A9ennes%2C%20nationales%20et%20locales%20disponibles%20sur%20Aides-territoires%2C%20en%20s%E2%80%99appuyant%20sur%20des%20partenariats%20ainsi%20qu%27une%20communaut%C3%A9%20de%20contributeurs%20constitu%C3%A9e%20dans%20les%20administrations%20ci-dessus%20cit%C3%A9es%20dans%20le%20but%20de%20r%C3%A9pondre%20au%20besoin%20d%27exhaustivit%C3%A9%20des%20acteurs%20locaux.%0A%0ADans%20un%20deuxi%C3%A8me%20temps%2C%20en%20capitalisant%20les%20donn%C3%A9es%20avec%20lesquelles%20les%20collectivit%C3%A9s%20alimentent%20les%20diff%C3%A9rents%20dossiers%2C%20cet%20outil%20permettra%20de%20les%20r%C3%A9utiliser%20%28%2ADites-le%20nous%20une%20fois%2A%29%20pour%20faciliter%20le%20remplissage%20des%20dossiers%E2%80%A6%20en%20proposant%20%2A%C3%A0%20terme%2A%20un%20test%20d%27%C3%A9ligibilit%C3%A9%20ou%20encore%20un%20service%20de%20d%C3%A9p%C3%B4t%20de%20projet%20en%20ligne.%0A

Aides-territoires

construction

acceleration

content-security-policy

Content Security Policy (CSP) implemented with unsafe sources inside style-src. This includes 'unsafe-inline', data: or overly broad sources such as https:.

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

public-key-pinning

HTTP Public Key Pinning (HPKP) header not implemented

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

Referrer-Policy header set to "no-referrer", "same-origin", "strict-origin" or "strict-origin-when-cross-origin"

strict-transport-security

HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000)

subresource-integrity

Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS

x-content-type-options

X-Content-Type-Options header set to "nosniff"

x-frame-options

X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive

x-xss-protection

X-XSS-Protection header not needed due to strong Content Security Policy (CSP) header

frame-ancestors *; base-uri 'self'; style-src 'self' 'unsafe-inline' https://stats.beta.gouv.fr; form-action 'self'; connect-src 'self' https://stats.data.gouv.fr https://in-automate.brevo.com/; worker-src blob:; img-src 'self' data: https://stats.data.gouv.fr https://*.scw.cloud https://*.forte.tiles.quaidorsay.fr; object-src 'none'; font-src 'self'; frame-src 'self' https://stats.data.gouv.fr https://www.youtube.com https://www.dailymotion.com https://aides-territoires-metabase.osc-fr1.scalingo.io; default-src https://*.scw.cloud; script-src 'self' https://stats.data.gouv.fr https://aides-territoires-metabase.osc-fr1.scalingo.io https://sibautomation.com 'nonce-dR2JDBtZENUAfefc1wm6Mw=='

Diagnostics

Metrics

http

https

A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.

CAA Record

An MX record was detected. MX records direct emails to a mail exchange server.

MX Record Detection

DNS DMARC - Detect

An NS record was detected. An NS record delegates a subdomain to a set of name servers.

NS Record Detection

A DNS TXT record was detected. The TXT record lets a domain admin leave notes on a DNS server.

DNS TXT Record Detected

Allowed Options Method

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

robots.txt endpoint prober

Checks if script tags within the HTML response have Subresource Integrity implemented via the integrity attribute


Missing Subresource Integrity

WAF Detection

An open redirect vulnerability was detected. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Open Redirect - Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

master

_pk_ses.62.6088

_pk_id.62.6088

sib_cuid

frame-ancestors *; base-uri 'self'; style-src 'self' 'unsafe-inline' https://stats.beta.gouv.fr; form-action 'self'; connect-src 'self' https://stats.data.gouv.fr https://in-automate.brevo.com/; worker-src blob:; img-src 'self' data: https://stats.data.gouv.fr https://*.scw.cloud https://*.forte.tiles.quaidorsay.fr; object-src 'none'; font-src 'self'; frame-src 'self' https://stats.data.gouv.fr https://www.youtube.com https://www.dailymotion.com https://aides-territoires-metabase.osc-fr1.scalingo.io; default-src https://*.scw.cloud; script-src 'self' https://stats.data.gouv.fr https://aides-territoires-metabase.osc-fr1.scalingo.io https://sibautomation.com 'nonce-0nX82ruGK5Dss39GPJ0twQ=='

Websites that have a shopping cart or checkout page, either using a known ecommerce platform or a custom solution.

Cart Functionality

Sendinblue is an email marketing solution for small and medium-sized businesses that want to send and automate email marketing campaigns.

Sendinblue

Select2 is a jQuery based replacement for select boxes. It supports searching, remote data sets, and infinite scrolling of results.

Select2

Matomo Analytics is a free and open-source web analytics application, that runs on a PHP/MySQL web-server.

Matomo Analytics

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Open Graph is a protocol that is used to integrate any web page into the social graph.

Open Graph

Absence of Anti-CSRF Tokens

CSP: Wildcard Directive

CSP: style-src unsafe-inline

Sub Resource Integrity Attribute Missing

Cross-Domain JavaScript Source File Inclusion

Dangerous JS Functions

Permissions Policy Header Not Set

Timestamp Disclosure - Unix

X-Content-Type-Options Header Missing

Base64 Disclosure

Information Disclosure - Suspicious Comments

Modern Web Application

Non-Storable Content

Re-examine Cache-control Directives

Sec-Fetch-Dest Header is Missing

Sec-Fetch-Mode Header is Missing

Sec-Fetch-Site Header is Missing

Sec-Fetch-User Header is Missing

Session Management Response Identified

Storable and Cacheable Content

User Controllable HTML Element Attribute (Potential XSS)

%23%20%2A%2AProbl%C3%A8me%2A%2A%0A%0AChaque%20ann%C3%A9e%2C%20plus%20de%2015%20000%20conventions%20sont%20sign%C3%A9es%20entre%20l%E2%80%99Etat%20et%20les%20bailleurs%20de%20logements%20sociaux%2C%20afin%20de%20permettre%20aux%20m%C3%A9nages%20d%E2%80%99acc%C3%A9der%20%C3%A0%20des%20logements%20sociaux.%0A%0ACependant%2C%20%2A%2Ale%20remplissage%20long%20et%20compliqu%C3%A9%20des%20conventions%20APL%20a%20de%20lourdes%20r%C3%A9percussions%20sur%20le%20suivi%20du%20logement%20social%2A%2A%20%28ex%20%3A%20erreurs%20sur%20le%20calcul%20des%20loyers%20et%20surfaces%29%20%3A%0A%0A%2A%20%2ADes%20mises%20en%20services%20sans%20convention%2A%2C%20avec%20des%20avenants%20rarement%20r%C3%A9alis%C3%A9s%2C%20entra%C3%AEnant%20une%20ins%C3%A9curit%C3%A9%20juridique%20et%20des%20sources%20d%E2%80%99erreur%20sur%20les%20statistiques%20du%20logement%20en%20France%0A%2A%20%2AAttentes%20de%20versement%20des%20APL%20pour%20les%20locataires%2A%2C%20en%20raison%20des%20difficult%C3%A9s%20d%27acc%C3%A8s%20aux%20conventions%20pour%20les%20autres%20parties%20prenantes%20du%20conventionnement%20%28ex%20%3A%20CAF%2C%20pr%C3%A9fectures%2C%20MSA%29%0A%0A%23%20Solution%0A%0A%2A%2AAPiLos%20permet%20ainsi%20de%20faciliter%20l%27acc%C3%A8s%20aux%20logements%20sociaux%20par%20la%20simplification%20des%20conventions.%2A%2A%C2%A0%0A%0AAPiLos%20a%20pour%20mission%20de%20%3A%C2%A0%0A%0A%2A%20%2AFaire%20gagner%20en%20rapidit%C3%A9%20la%20saisie%20par%20les%20bailleurs%20de%20logements%20sociaux%2C%20ainsi%20que%20les%20instructions%2A%20par%20les%20services%20d%C3%A9concentr%C3%A9s%20de%20l%E2%80%99Etat%20et%20les%20collectivit%C3%A9s%20d%C3%A9l%C3%A9gataires%0A%2A%20A%20terme%2C%20de%20%2Adisposer%20de%20statistiques%20en%20temps%20r%C3%A9el%20sur%20la%20politique%20du%20logement%20en%20France%2A%0A%0ALe%20bailleur%20dispose%20d%27une%20plateforme%20pour%20remplir%20simplement%20sa%20convention%20APL%20et%20t%C3%A9l%C3%A9verser%20les%20documents%20n%C3%A9cessaires.%20La%20convention%20est%20ensuite%20transmise%20%C3%A0%20l%27instructeur%2C%20qui%20peut%20v%C3%A9rifier%20les%20donn%C3%A9es%20directement%20sur%20la%20plateforme%2C%20et%20faire%20part%20aux%20bailleurs%20de%20ses%20demandes%20de%20modifications.%20Lorsque%20les%20deux%20parties%20sont%20d%27accord%2C%20le%20document%20de%20convention%20est%20automatiquement%20g%C3%A9n%C3%A9r%C3%A9%20au%20format%20CERFA.%0A%0A%23%20Impact%0A%0A%23%23%23%20Enjeux%202023%20%3A%0A%0A%2A%20%2APr%C3%A9parer%20le%20rattachement%20d%E2%80%99APiLos%20au%20SIAP%20en%20avril%202023%2A%0A%0AAPiLos%20via%20une%20API%20se%20rattachera%20au%20syst%C3%A8me%20d%27Information%20des%20Aides%20%C3%A0%20la%20Pierre%20%28SIAP%29%2C%20d%C3%A9velopp%C3%A9%20par%20les%20%C3%A9quipes%20du%20minist%C3%A8re%20en%20charge%20du%20logement.%20Cet%20ambitieux%20projet%20SI%20vise%20%C3%A0%20refondre%20la%20fa%C3%A7on%20dont%20sont%20financ%C3%A9s%20puis%20conventionn%C3%A9s%20les%20logements%20sociaux%2C%20en%20France.%20Le%20SIAP%20entrera%20en%20production%20au%20niveau%20national%20en%20avril%202023.%C2%A0%0A%0A%2A%20%2AAvoir%20les%20premi%C3%A8res%20statistiques%20publi%C3%A9es%20de%20la%20mise%20en%20services%20des%20logements%20sociaux%20pour%20l%E2%80%99ann%C3%A9e%202023%2A%0A%2A%20%2AInvestiguer%20et%20rechercher%20de%20nouveaux%20impacts%20aupr%C3%A8s%20de%20nouveaux%20partenaires%20%28CAF%2C%20SPF%E2%80%A6%29%2A%C2%A0%0A%0A%23%23%23%20Les%20objectifs%20dat%C3%A9s%0A%0A%2A%20Fin%20f%C3%A9vrier%20-%20%2ADisposer%20de%2050%20couples%20Instructeurs-bailleurs%20form%C3%A9s%20%C3%A0%20l%E2%80%99utilisation%20d%E2%80%99APiLos%2A%2C%20afin%20de%20d%C3%A9risquer%20le%20d%C3%A9ploiement%20national%20d%E2%80%99APiLos%20en%20avril%202023%20en%20France%0A%2A%20Fin%20mars%20-%20%2ACouvrir%20l%27ensemble%20des%20fonctionnalit%C3%A9s%20requises%20pour%20r%C3%A9pondre%20%C3%A0%20100%20%25%20des%20besoins%20de%20conventionnement%2A%20%28ex%20%3A%20convention%20HLM%2C%20foyers%20r%C3%A9sidences...%29%0A%2A%20Fin%20mai%20-%20%2AAvoir%20assur%C3%A9%20le%20maintien%20de%20l%E2%80%99exp%C3%A9rience%20utilisateur%20apr%C3%A8s%20la%20bascule%20d%E2%80%99APiLos%20dans%20le%20SIAP%2A%0A%0A%23%23%23%20Les%20KPI%0A%0A%2A%20Aujourd%27hui%2C%20%2AAPiLos%20est%20pr%C3%A9sent%20dans%20plus%20de%2035%20d%C3%A9partements%2A.%C2%A0%0A%2A%20%2ADepuis%20sa%20mise%20en%20ligne%209%20400%20logements%20ont%20%C3%A9t%C3%A9%20r%C3%A9alis%C3%A9s%20via%20la%20plateforme%20APiLos.%2A%20%28A%20titre%20de%20comparaison%2C%20en%202021%2C%2075%20000%20logements%20ont%20%C3%A9t%C3%A9%20mis%20en%20service%29.%20Ainsi%2C%20APiLos%20serait%20en%20mesure%20de%20couvrir%2010%25%20du%20parc%20de%20logements%20sociaux.%C2%A0%20%0A%2A%20Nous%20mesurons%20%C3%A9galement%20notre%20impact%20via%20deux%20indicateurs%20%3A%20%2Ale%20temps%20de%20traitement%20d%E2%80%99une%20convention%20et%20la%20satisfaction%20de%20nos%20560%20bailleurs%20et%20plus%20de%20260%20instructeurs%20utilisateurs%2A.%20%0A%0A%23%23%23%20Les%20statistiques%0A%0A%2A%20%2A%2A%3Chttps%3A%2F%2Fapilos.beta.gouv.fr%2Fstats%2F%3E%2A%2A%0A

product_launch

APiLos

investigation

Server-side requests should not be vulnerable to forging attacks

pythonsecurity:S5144

SonarCloud

Clear-text logging of sensitive information

py/clear-text-logging-sensitive-data

CodeQL

PostgreSQL database passwords should not be disclosed

secrets:S6698

All cookies use the Secure flag, session cookies use the HttpOnly flag, and cross-origin restrictions are in place via the SameSite flag

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

X-Frame-Options (XFO) header set to SAMEORIGIN or DENY

manifest-src 'self'; connect-src 'self' https://stats.data.gouv.fr/piwik.php https://client.crisp.chat https://storage.crisp.chat wss://client.relay.crisp.chat wss://stream.relay.crisp.chat; style-src 'self' https://code.highcharts.com/css/highcharts.css https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/swagger-ui.css 'unsafe-inline' https://client.crisp.chat; default-src 'none'; frame-src 'self' https://www.dailymotion.com/embed/video/x8fkp4y https://www.dailymotion.com/embed/video/x8frr91 https://game.crisp.chat https://metabase.apilos.beta.gouv.fr/public/dashboard/b91cd727-95e2-44c7-b8ae-0cf4a235abfb; object-src 'none'; media-src https://client.crisp.chat; script-src https://stats.data.gouv.fr/piwik.js 'self' 'sha256-zaYxlJmjbzgo2YczX5XHFlvamZUNy264d7XlOOUwMME=' 'sha256-928U3JmFf9xytJJBtEU5V1FVGcqsTfwaVnI2vmHmamA=' 'sha256-lkrKw/baCFdnI+tB9T+0yFMewpXSk9yct2ZbWEGPDhY=' 'sha256-J71e5kr85q2XGRl+qwOA/tpMsXmKDjeTnvlzBhBsz/0=' 'sha256-h7boyH6dI/JQnsm6Iw1sAtEbdb/+638kREPj4sfWmMs=' 'sha256-7uHmVaAHWxl0RElSoWED7kK+9kRSQ+E6SQ3aBK1prkU=' https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/swagger-ui-bundle.js https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/swagger-ui-standalone-preset.js https://client.crisp.chat https://settings.crisp.chat 'nonce-11phHMT8B218gVT0yg4n6Q=='; font-src 'self' data: https://client.crisp.chat; img-src 'self' data: https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/favicon-32x32.png https://client.crisp.chat https://image.crisp.chat https://storage.crisp.chat

Checks whether cookies in the HTTP response contain the HttpOnly attribute. If the HttpOnly flag is set, it means that the cookie is HTTP-only


HttpOnly Cookie - Detect

develop

_pk_ses.188.b4f2

_pk_id.188.b4f2

sc-sticky-session

manifest-src 'self'; connect-src 'self' https://stats.data.gouv.fr/piwik.php https://client.crisp.chat https://storage.crisp.chat wss://client.relay.crisp.chat wss://stream.relay.crisp.chat; style-src 'self' https://code.highcharts.com/css/highcharts.css https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/swagger-ui.css 'unsafe-inline' https://client.crisp.chat; default-src 'none'; frame-src 'self' https://www.dailymotion.com/embed/video/x8fkp4y https://www.dailymotion.com/embed/video/x8frr91 https://game.crisp.chat https://metabase.apilos.beta.gouv.fr/public/dashboard/b91cd727-95e2-44c7-b8ae-0cf4a235abfb; object-src 'none'; media-src https://client.crisp.chat; script-src https://stats.data.gouv.fr/piwik.js 'self' 'sha256-zaYxlJmjbzgo2YczX5XHFlvamZUNy264d7XlOOUwMME=' 'sha256-928U3JmFf9xytJJBtEU5V1FVGcqsTfwaVnI2vmHmamA=' 'sha256-lkrKw/baCFdnI+tB9T+0yFMewpXSk9yct2ZbWEGPDhY=' 'sha256-J71e5kr85q2XGRl+qwOA/tpMsXmKDjeTnvlzBhBsz/0=' 'sha256-h7boyH6dI/JQnsm6Iw1sAtEbdb/+638kREPj4sfWmMs=' 'sha256-7uHmVaAHWxl0RElSoWED7kK+9kRSQ+E6SQ3aBK1prkU=' https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/swagger-ui-bundle.js https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/swagger-ui-standalone-preset.js https://client.crisp.chat https://settings.crisp.chat 'nonce-YPwtfr/MC+9BtjynvyMWMQ=='; font-src 'self' data: https://client.crisp.chat; img-src 'self' data: https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/favicon-32x32.png https://client.crisp.chat https://image.crisp.chat https://storage.crisp.chat

Progressive Web Apps (PWAs) are web apps built and enhanced with modern APIs to deliver enhanced capabilities, reliability, and installability while reaching anyone, anywhere, on any device, all with a single codebase.

URL (2)	Phase	Déclaration d'accessibilité	Mentions légales	Politique de confidentialité	Eco-index	Accessibilité	Performance	SEO	SSL	HTTP	Disponibilité	Apdex	Vulnérabilités	CodeScan	Nmap	Ports ouverts	Trackers	Cookies	Stats	Budget	404	SonarCloud
aides-territoires.beta.gouv.fr
apilos.beta.gouv.fr