securite: #87 T3 cookies Secure centralises + CORS atteste (defaut inchange)

backend/main.py

@@ -249,6 +249,17 @@ async def lifespan(app: FastAPI):
     # BUG-037: refuse to expose an unauthenticated instance on a public bind.
     _guard_insecure_auth()
 
+    # #87 T3 : avertir quand les cookies d'auth circulent sans flag Secure
+    # sur un bind non-loopback (transactions observables en clair).
+    from backend.auth.middleware import bind_host_from_argv, is_auth_enabled, is_loopback_host
+    from backend.auth.router import is_secure_cookies
+
+    if is_auth_enabled() and not is_secure_cookies() and not is_loopback_host(bind_host_from_argv()):
+        logger.warning(
+            "Cookies d'authentification sans flag `Secure` sur un bind non-loopback : "
+            "activez TLS et posez OBSIGATE_SECURE_COOKIES=true en production."
+        )
+
     # Bootstrap admin account if needed
     bootstrap_admin()