diff --git a/app/Http/Middleware/ForceHttps.php b/app/Http/Middleware/ForceHttps.php
new file mode 100644
index 0000000..94077f2
--- /dev/null
+++ b/app/Http/Middleware/ForceHttps.php
@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class ForceHttps
+{
+    public function handle(Request $request, Closure $next)
+    {
+        // En production, forcer HTTPS même si on arrive en HTTP
+        if (!app()->environment('local') && !$request->isSecure()) {
+            return redirect(
+                str_replace('http://', 'https://', $request->url()),
+                308
+            )->send();
+        }
+
+        return $next($request);
+    }
+}
diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index 92b6d93..83152da 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -21,11 +21,7 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        // Forcer HTTPS absolument en production (peu importe le proxy)
-        if (!app()->environment('local')) {
-            URL::forceScheme('https');
-            // Accepter les headers du reverse proxy
-            SymfonyRequest::setTrustedProxies(['*'], -1);
-        }
+        // ForceHttps middleware se charge de forcer HTTPS
+        // TrustProxies middleware reconnaît les headers du proxy
     }
 }
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 47c5884..7d7bd0e 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -4,6 +4,7 @@ use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
 use App\Http\Middleware\SecurityHeaders;
+use App\Http\Middleware\ForceHttps;
 
 return Application::configure(basePath: dirname(__DIR__))
     ->withRouting(
@@ -12,6 +13,7 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        $middleware->append(ForceHttps::class);
         $middleware->append(SecurityHeaders::class);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
diff --git a/public/.htaccess b/public/.htaccess
index b574a59..1bfbc96 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -5,6 +5,18 @@
 
     RewriteEngine On
 
+    # Reconnaître les headers du reverse proxy pour HTTPS
+    <IfModule mod_setenvif.c>
+        SetEnvIf X-Forwarded-Proto "https" HTTPS=on
+        SetEnvIf X-Forwarded-Proto "^https$" SSL_PROTOCOL=TLSv1
+    </IfModule>
+
+    # Forcer HTTPS en production
+    RewriteCond %{ENV:HTTPS} !=on
+    RewriteCond %{HTTP_HOST} !^localhost
+    RewriteCond %{HTTP_HOST} !^127\.0\.0\.1
+    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
+
     # Handle Authorization Header
     RewriteCond %{HTTP:Authorization} .
     RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
diff --git a/resources/views/connexion/login.blade.php b/resources/views/connexion/login.blade.php
index b906308..8ea41f9 100644
--- a/resources/views/connexion/login.blade.php
+++ b/resources/views/connexion/login.blade.php
@@ -16,7 +16,6 @@
             @endif
             
             <form action="{{ route('login.store') }}" method="POST" class="space-y-4">
-                <input type = "hidden" name = "_ token" value = "{{csrf_token ()}}">
                 @csrf
                 <div>
                     <label for="Email" class="block text-sm font-bold mb-2 text-gray-700">Email</label>