✨ feat(sécurité): Améliore la configuration CSP et Permissions-Policy pour plus de contrôle.

config/packages/nelmio_security.yaml

@@ -1,5 +1,19 @@
 nelmio_security:
     # Content Security Policy (CSP)
+    referrer_policy:
+        enabled: true
+        policies:
+            - 'strict-origin-when-cross-origin'
+    permissions_policy:
+        enabled: true
+        policies:
+            camera: [self]         # Correct : sans les guillemets simples internes
+            microphone: [self]     # Correct
+            geolocation: [self]    # Correct
+            fullscreen: [self]     # Correct
+            payment: [self]        # Correct
+            # Si tu veux bloquer une fonction pour tout le monde :
+            usb: []
     csp:
         enforce:
             default-src: ["'self'"]
@@ -10,6 +24,7 @@ nelmio_security:
                 - "https://chat.esy-web.dev"
                 - "https://auth.esy-web.dev"
                 - "https://static.cloudflareinsights.com"
+                - "https://challenges.cloudflare.com"
                 - "'strict-dynamic'"
             connect-src:
                 - "'self'"
@@ -17,10 +32,12 @@ nelmio_security:
                 - "https://chat.esy-web.dev"
                 - "https://auth.esy-web.dev"
                 - "https://cloudflareinsights.com"
+                - "https://challenges.cloudflare.com"
             frame-src:
                 - "'self'"
                 - "https://chat.esy-web.dev"
                 - "https://auth.esy-web.dev"
+                - "https://challenges.cloudflare.com"
             style-src:
                 - "'self'"
                 - "'unsafe-inline'"