# config/packages/nelmio_security.yaml
nelmio_security:
    forced_ssl:
        enabled: true
        hsts_max_age: 31536000
        hsts_subdomains: true
        hsts_preload: true
        redirect_status_code: 301

    permissions_policy:
        enabled: true
        policies:
            camera: []
            microphone: []
            geolocation: []
            payment: []
            usb: []
            
    csp:
        enforce:
            default-src:
                - "'none'"
            
            script-src:
                - "'self'"
            
            style-src:
                - "'self'"
            
            font-src:
                - "'self'"
            
            img-src:
                - "'self'"
                - 'data:'  # Garde uniquement pour les images
            
            object-src:
                - "'none'"
            
            base-uri:
                - "'self'"
            
            frame-ancestors:
                - "'none'"
            
            connect-src:
                - "'self'"
            
            form-action:
                - "'self'"

    content_type:
        nosniff: true

    referrer_policy:
        enabled: true
        policies:
            - 'no-referrer'
            - 'strict-origin-when-cross-origin'

    clickjacking:
        paths:
            '^/.*': DENY  # Protection contre le clickjacking

    external_redirects:
        abort: true  # Bloque les redirections externes non autorisées

