Fix CORS blocking errors for CDN resources (v1.2.1-beta)

Fixed ERR_BLOCKED_BY_RESPONSE.NotSameOrigin errors by implementing proper CORS headers for public resources:
- Added Access-Control-Allow-Origin: * for public assets
- Changed Cross-Origin-Resource-Policy to cross-origin for CDN files
- Maintained strict security for sensitive routes
- Added cache control for optimal CDN performance

Affected files:
- /public/* (images, CSS, JS, fonts)
- /cdn-files/* (uploaded files)
- /attachments (file serving)

Middlewares/securityHeadersMiddleware.js

@@ -67,8 +67,26 @@ const securityHeadersMiddleware = (req, res, next) => {
     // Cross-Origin-Opener-Policy - Isole le contexte de navigation
     res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
 
-    // Cross-Origin-Resource-Policy - Contrôle le partage de ressources
+    // CORS Headers pour CDN - Permet l'accès cross-origin aux ressources publiques
+    const isPublicResource = req.path.startsWith('/public/') ||
+                             req.path.startsWith('/cdn-files/') ||
+                             req.path.startsWith('/attachments') ||
+                             req.path.match(/\.(png|jpg|jpeg|gif|svg|webp|ico|css|js|woff|woff2|ttf|eot)$/i);
+
+    if (isPublicResource) {
+        // Autoriser toutes les origines pour les ressources publiques du CDN
+        res.setHeader('Access-Control-Allow-Origin', '*');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept, Range');
+        res.setHeader('Access-Control-Expose-Headers', 'Content-Length, Content-Range, Content-Type');
+        res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+
+        // Cache control pour les ressources statiques
+        res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+    } else {
+        // Routes sensibles : garder la sécurité stricte
         res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+    }
 
     next();
 };

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cdn-app/insider-myaxrin-labs-dinawo",
-  "version": "1.2.0-beta",
+  "version": "1.2.1-beta",
   "description": "",
   "main": "server.js",
   "scripts": {