feat: improve security headers and csp nonce handling

categories.php

@@ -87,7 +87,7 @@ if ($categoryId && isset($allCategories[$categoryId])) {
     ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;

countdown.php

@@ -57,7 +57,7 @@ setSecurityHeaders();
     <meta name="twitter:image" content="<?php echo 'https://' . $_SERVER['HTTP_HOST'] . '/img/logo.png'; ?>">
 
     <!-- Configuration JavaScript -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         const COUNTDOWN_TARGET_DATE = '<?php echo defined('COUNTDOWN_TARGET_DATE') ? COUNTDOWN_TARGET_DATE : '2025-10-11 00:00:00'; ?>';
     </script>
 </head>

direct.php

@@ -50,7 +50,7 @@ $liveStream = getLiveStream();
     <meta name="twitter:image" content="<?php echo getBaseUrl(); ?>/img/logo.png">
     
     <!-- Données structurées JSON-LD pour la page direct -->
-    <script type="application/ld+json">
+    <script type="application/ld+json" nonce="<?php echo getCspNonce(); ?>">
     {
         "@context": "https://schema.org",
         "@type": "WebPage",
@@ -85,7 +85,7 @@ $liveStream = getLiveStream();
     ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -163,7 +163,7 @@ $liveStream = getLiveStream();
                             $bgImageStyle = 'background-image: url(\'' . htmlspecialchars(NEXT_LIVE_IMAGE) . '\');';
                         }
                         ?>
-                        <div class="next-live-announcement" style="<?php echo $bgImageStyle; ?>">
+                        <div class="next-live-announcement" style="<?php echo $bgImageStyle; ?>" nonce="<?php echo getCspNonce(); ?>">
                             <?php if (!empty(NEXT_LIVE_IMAGE) && file_exists(NEXT_LIVE_IMAGE)): ?>
                                 <div class="next-live-image-container">
                                     <img src="<?php echo htmlspecialchars(NEXT_LIVE_IMAGE); ?>"

includes/header.php

@@ -74,7 +74,7 @@
         <button id="theme-toggle" class="icon-button" aria-label="Basculer entre mode clair et sombre" title="Changer le thème">
             <i class="fas fa-sun" aria-hidden="true"></i>
         </button>
-        <button id="install-pwa" class="icon-button install-pwa-button" style="display: none;" aria-label="Installer l'application">
+        <button id="install-pwa" class="icon-button install-pwa-button" style="display: none;" nonce="<?php echo getCspNonce(); ?>" aria-label="Installer l'application">
             <i class="fas fa-download" aria-hidden="true"></i>
         </button>
         <button class="mobile-menu-toggle" aria-expanded="false" aria-controls="mobile-menu" aria-label="Ouvrir le menu de navigation">

includes/hero-section.php

@@ -82,7 +82,7 @@ if ($heroType === 'none') {
                     $bgImageStyle = 'background-image: url(\'' . htmlspecialchars(NEXT_LIVE_IMAGE) . '\');';
                 }
                 ?>
-                <div class="hero-next-live" style="<?php echo $bgImageStyle; ?>">
+                <div class="hero-next-live" style="<?php echo $bgImageStyle; ?>" nonce="<?php echo getCspNonce(); ?>">
                     <?php if (!empty(NEXT_LIVE_IMAGE) && file_exists(NEXT_LIVE_IMAGE)): ?>
                         <div class="hero-next-live-image-container">
                             <img src="<?php echo htmlspecialchars(NEXT_LIVE_IMAGE); ?>"

includes/pwa-init.php

@@ -18,7 +18,7 @@ function addPWAHeaders() {
 function addPWAScripts() {
     ?>
     <!-- PWA Service Worker -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         if ('serviceWorker' in navigator) {
             window.addEventListener('load', function() {
                 navigator.serviceWorker.register('/sw.js')

includes/security.php

@@ -177,6 +177,19 @@ function validateCSRFToken($token) {
     return hash_equals($_SESSION['csrf_token'], $token);
 }
 
+/**
+ * Génère ou récupère le nonce CSP de la requête courante.
+ * Doit être appelé après setSecurityHeaders() pour que le nonce soit envoyé dans le header CSP.
+ *
+ * @return string Nonce CSP
+ */
+function getCspNonce() {
+    if (!isset($GLOBALS['csp_nonce'])) {
+        $GLOBALS['csp_nonce'] = base64_encode(random_bytes(16));
+    }
+    return $GLOBALS['csp_nonce'];
+}
+
 /**
  * Applique des en-têtes de sécurité HTTP
  */
@@ -193,7 +206,16 @@ function setSecurityHeaders() {
     // Politique de référent
     header('Referrer-Policy: strict-origin-when-cross-origin');
 
+    // Isolation cross-origin
+    header('Cross-Origin-Resource-Policy: same-origin');
+    header('Cross-Origin-Opener-Policy: same-origin');
+    header('Cross-Origin-Embedder-Policy: require-corp');
+
+    // Permissions Policy (feature policy)
+    header('Permissions-Policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()');
+
     // Content Security Policy avec support Mastodon et PeerTube
+    $nonce = getCspNonce();
     $mastodonDomain = '';
     $peertubeDomain = '';
 
@@ -217,10 +239,10 @@ function setSecurityHeaders() {
     $isLocalDev = in_array($_SERVER['HTTP_HOST'] ?? '', ['127.0.0.1:8080', '127.0.0.1:8001', 'localhost:8080', 'localhost:8001', '127.0.0.1', 'localhost']);
 
     $csp = "default-src 'self'; ";
-    $csp .= "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; ";
+    $csp .= "style-src 'self' 'nonce-{$nonce}' https://cdnjs.cloudflare.com; ";
-    $csp .= "script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://plausible.io; "; // PLAUSIBLE UPDATED
+    $csp .= "script-src 'self' 'nonce-{$nonce}' https://cdnjs.cloudflare.com https://plausible.io; ";
 
-    // Images : autoriser les domaines externes plus HTTPS général en dev
+    // Images : autoriser les domaines connus plus HTTPS général pour le contenu fédéré
     $imgSrc = "'self' data: " . ($mastodonDomain ? $mastodonDomain : '') . " " . ($peertubeDomain ? $peertubeDomain : '');
     if ($isLocalDev) {
         $imgSrc .= " https: http:";
@@ -231,31 +253,27 @@ function setSecurityHeaders() {
 
     $csp .= "font-src 'self' https://cdnjs.cloudflare.com; ";
 
-    // Frames : autoriser PeerTube et HTTPS général
+    // Frames : autoriser PeerTube uniquement
     $frameSrc = "'self' " . ($peertubeDomain ? $peertubeDomain : '');
     if ($isLocalDev) {
         $frameSrc .= " https: http:";
-    } else {
-        $frameSrc .= " https:";
     }
     $csp .= "frame-src " . $frameSrc . "; ";
 
-    // Connexions : autoriser Mastodon et PeerTube
+    // Connexions : autoriser Mastodon, PeerTube et Plausible
     $connectSrc = "'self' https://plausible.io " . ($mastodonDomain ? $mastodonDomain : '') . " " . ($peertubeDomain ? $peertubeDomain : '');
     if ($isLocalDev) {
         $connectSrc .= " ws: wss:"; // WebSockets pour le dev
     }
     $csp .= "connect-src " . $connectSrc . "; ";
 
-    // Médias : toujours autoriser 'self', Mastodon et PeerTube
+    // Médias : autoriser 'self', Mastodon, PeerTube et S3 Mastodon
     $mediaSrc = "'self'";
 
-    // Ajouter l'instance Mastodon (pour les médias stockés sur l'instance)
     if ($mastodonDomain) {
         $mediaSrc .= " " . $mastodonDomain;
     }
 
-    // Ajouter PeerTube
     if ($peertubeDomain) {
         $mediaSrc .= " " . $peertubeDomain;
     }
@@ -277,13 +295,14 @@ function setSecurityHeaders() {
     $csp .= "media-src " . $mediaSrc . "; ";
 
     $csp .= "object-src 'none'; ";
-    $csp .= "base-uri 'self';";
+    $csp .= "base-uri 'self'; ";
+    $csp .= "frame-ancestors 'self';";
 
     header('Content-Security-Policy: ' . $csp);
 
     // HTTPS strict transport security (seulement si HTTPS)
     if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
-        header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
+        header('Strict-Transport-Security: max-age=63072000; includeSubDomains; preload');
     }
 }
 

includes/structured-data.php

@@ -313,7 +313,8 @@ function getBaseUrl() {
  * @param string $jsonLd Données JSON-LD
  */
 function outputJsonLd($jsonLd) {
-    echo '<script type="application/ld+json">' . "\n" . $jsonLd . "\n" . '</script>' . "\n";
+    $nonce = getCspNonce();
+    echo '<script type="application/ld+json" nonce="' . $nonce . '">' . "\n" . $jsonLd . "\n" . '</script>' . "\n";
 }
 
 ?>

index.php

@@ -81,7 +81,7 @@ setSecurityHeaders();
     ?>
 
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -679,7 +679,7 @@ setSecurityHeaders();
     <script src="js/mastodon-config.php?v=<?php echo md5(MASTODON_INSTANCE_URL . MASTODON_DATE_FORMAT . MASTODON_BTN_SEE_MORE . MASTODON_BTN_RELOAD . MASTODON_MAX_POST_FETCH . MASTODON_MAX_POST_SHOW); ?>"></script>
 
     <!-- PWA Service Worker -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         if ('serviceWorker' in navigator) {
             window.addEventListener('load', function() {
                 navigator.serviceWorker.register('/sw.js')

recherche.php

@@ -105,7 +105,7 @@ if ($resultsCount > 0) {
     <?php endif; ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;

video.php

@@ -167,7 +167,7 @@ if (empty($videoData) || isset($videoData['error'])) {
     <?php endif; ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -330,7 +330,7 @@ if (empty($videoData) || isset($videoData['error'])) {
                                     <i class="fas fa-chevron-down" aria-hidden="true"></i>
                                 </button>
                             </div>
-                            <div id="full-description" class="full-description" style="display: none;">
+                            <div id="full-description" class="full-description" style="display: none;" nonce="<?php echo getCspNonce(); ?>">
                                 <?php echo markdown_to_html($video['description']); ?>
                                 <button class="show-less-btn" aria-expanded="true" aria-controls="full-description">
                                     <span>Voir moins</span>
@@ -566,7 +566,7 @@ if (empty($videoData) || isset($videoData['error'])) {
     </div>
     
     <script src="js/main.js"></script>
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         // Script pour la modal de téléchargement
         document.addEventListener('DOMContentLoaded', function() {
             // Gestion de la description tronquée