[Sécurité - Audit] Absence de restriction CORS #3640

sfinx13 · 2025-01-30T09:38:50Z

Ticket

Description

Changements apportés

Suppression de la conf nginx pour empecher les appels ajax cross domain (comportement par défaut)

Pré-requis

make build

Créer ce fichier et exécuter le sur un autre port (Utilisation du serveur interne vscode port : 5500)

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Cors test</title>
</head>
<body>
    <p>Cors test</p>
    <script>
        fetch('http://localhost:8080/statistiques-filter?territoire=all', {
            method: 'GET',
          })
        .then(response => {
            if (!response.ok) {
                throw new Error(`Erreur HTTP : ${response.status}`);
            }
                return response.json();
            })
        .then(data => console.log('Réponse OK:', data))
        .catch(error => console.error('Erreur CORS:', error));
          
    </script>
</body>
</html>

Tests

Exécuter le script ajax sur un serveur différent et vérifier que l'appel est bloqué par la plateforme comme sur la copie d'écran.

sonarqubecloud · 2025-02-03T10:24:35Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

numew

Ok

sfinx13 force-pushed the feature/3563-handle-cors branch from f8e53d6 to 5187c4c Compare January 30, 2025 09:43

sfinx13 requested review from hmeneuvrier, emilschn and numew January 30, 2025 09:49

remove nginx conf #3563

c398909

sfinx13 force-pushed the feature/3563-handle-cors branch from 6cbf7d6 to c398909 Compare February 3, 2025 10:23

numew approved these changes Feb 3, 2025

View reviewed changes

numew merged commit 439c9c2 into develop Feb 3, 2025
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Sécurité - Audit] Absence de restriction CORS #3640

[Sécurité - Audit] Absence de restriction CORS #3640

sfinx13 commented Jan 30, 2025 •

edited

Loading

sonarqubecloud bot commented Feb 3, 2025

numew left a comment

[Sécurité - Audit] Absence de restriction CORS #3640

[Sécurité - Audit] Absence de restriction CORS #3640

Conversation

sfinx13 commented Jan 30, 2025 • edited Loading

Ticket

Description

Changements apportés

Pré-requis

Tests

sonarqubecloud bot commented Feb 3, 2025

Quality Gate passed

numew left a comment

Choose a reason for hiding this comment

sfinx13 commented Jan 30, 2025 •

edited

Loading