cda9a7a8ff
H1 — trusted_proxies RFC-1918 dans framework.yaml : rate limiting
opérationnel derrière Traefik (IP client réelle, pas IP Traefik)
H2 — En-têtes HTTP dans Caddyfile : X-Frame-Options DENY,
X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy,
suppression header Server
H3 — API Platform docs désactivés en when@prod (Swagger UI, ReDoc)
M1 — Rate limiter sur DELETE /api/push/subscribe (manquant)
M2 — Validation FILTER_VALIDATE_URL sur endpoint push avant stockage
M3 — APP_ENV=prod dans backend/.env (était dev — risque si .env.local absent)
M4 — Limite 4096 octets sur le body JSON (FeedbackController + PushController)
M5 — Service Worker : open redirect corrigé (targetUrl validé contre l'origine)
B1 — robots.txt créé (bloque /api/ et /bundles/)
B3 — --time-limit=3600 sur les workers Messenger (rotation + libération mémoire)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
40 lines
761 B
Caddyfile
40 lines
761 B
Caddyfile
{
|
|
frankenphp
|
|
order php_server before file_server
|
|
}
|
|
|
|
:80 {
|
|
root * /app/public
|
|
|
|
header {
|
|
X-Frame-Options "DENY"
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
Permissions-Policy "camera=(), microphone=(), geolocation=()"
|
|
-Server
|
|
}
|
|
|
|
# Assets Symfony (webpack encore)
|
|
handle /bundles/* {
|
|
file_server
|
|
}
|
|
|
|
# Service worker (must be served from root scope)
|
|
handle /sw.js {
|
|
file_server
|
|
}
|
|
|
|
# API → Symfony front controller
|
|
handle /api/* {
|
|
php_server
|
|
}
|
|
|
|
# SPA React : try static files first, fallback to index.html
|
|
handle {
|
|
try_files {path} /index.html
|
|
file_server
|
|
}
|
|
|
|
encode gzip
|
|
}
|