fix(backend): ajoute l'en-tete Cross-Origin-Resource-Policy sur toutes les reponses

2026-09-23 09:36:10 +02:00
parent 59f050ec5e
commit cfc194a3fb
4 changed files with 11 additions and 4 deletions
@@ -16,6 +16,9 @@ EN_TETES: Final[dict[str, str]] = {
    "X-Content-Type-Options": "nosniff",
    "X-Frame-Options": "DENY",
    "Referrer-Policy": "no-referrer",
+    # same-origin : le frontend ne consomme l'API qu'au travers d'un proxy same-origin
+    # (proxy.conf.json en dev, ingress /api en prod, cf. docs/architecture/20-backend.md).
+    "Cross-Origin-Resource-Policy": "same-origin",
 }

 PREFIXE_AUTHENTIFICATION: Final = "/auth"