diff --git a/main.py b/main.py
index d233c9f..697afc8 100644
--- a/main.py
+++ b/main.py
@@ -8,7 +8,17 @@ from config import config
 
 def create_app():
     app = Flask(__name__)
-    CORS(app)
+
+    origins = [
+        "http://localhost:3000",
+        "http://127.0.0.1:3000"
+    ]
+    CORS(app, supports_credentials=True, origins=origins)
+
+    app.config.update(
+        SESSION_COOKIE_SAMESITE="None",   # necessary for cross-site cookies
+        SESSION_COOKIE_SECURE=False       # True in prod (HTTPS)
+    )
 
     env = os.environ.get('FLASK_ENV', 'default')
     app.config.from_object(config[env])
diff --git a/src/api/__pycache__/routes.cpython-312.pyc b/src/api/__pycache__/routes.cpython-312.pyc
index 66b3612..6adee48 100644
Binary files a/src/api/__pycache__/routes.cpython-312.pyc and b/src/api/__pycache__/routes.cpython-312.pyc differ
diff --git a/src/api/routes.py b/src/api/routes.py
index bfd90b6..89d042c 100644
--- a/src/api/routes.py
+++ b/src/api/routes.py
@@ -4,6 +4,7 @@ import os
 import zipfile
 
 import requests
+import uuid
 from flask import Blueprint, jsonify, request, session, send_file
 from werkzeug.utils import secure_filename
 from src.services.tmdb_service import TMDBService
@@ -25,9 +26,7 @@ user_csvs = {}
 def get_poster_url(movie_name, movie_year):
     movie = tmdb_service.search_movie(movie_name, movie_year)
     if movie:
-        posters = tmdb_service.get_movie_posters(movie['id'])
-        if posters:
-            return posters[0]
+        return movie['poster_path']
     return None
 
 
@@ -106,6 +105,10 @@ def allowed_file(filename):
 def upload_csv():
     user_id = session.get('user_id')
 
+    if not user_id:
+            user_id = str(uuid.uuid4())
+            session['user_id'] = user_id
+
     if 'file' not in request.files:
         return jsonify({'error': 'No file part'}), 400
     file = request.files['file']
@@ -160,17 +163,74 @@ def delete_csv():
         return jsonify({'error': 'An error occurred while deleting the CSV file'}), 500
 
 
+@api_bp.route('/fetch-diary', methods=['POST'])
+def fetch_diary_from_username():
+    """
+    Récupère le diary via l'API publique (api.hugo-pierret.be), transforme en CSV et
+    le stocke dans user_csvs[user_id] pour que le front continue à utiliser le même flux que l'upload.
+    """
+    try:
+        data = request.get_json() or {}
+        username = data.get('username')
+        if not username:
+            return jsonify({'error': 'username required'}), 400
+
+        user_id = session.get('user_id')
+        if not user_id:
+            user_id = str(uuid.uuid4())
+            session['user_id'] = user_id
+
+        api_url = f"https://api.hugo-pierret.be/letterboxd/diary?username={username}"
+        resp = requests.get(api_url)
+        if resp.status_code != 200:
+            return jsonify({'error': 'Failed to fetch diary from upstream API'}), 502
+
+        payload = resp.json()
+        entries = payload.get('entries', [])
+        if not entries:
+            return jsonify({'error': 'No entries returned by upstream API'}), 404
+
+        rows = []
+        import re
+        for e in entries:
+            title = e.get('title') or ""
+            date = e.get('date') or ""
+
+            m = re.match(r"^(?P<name>.+?)\s*\((?P<year>\d{4})\)\s*$", title)
+            if m:
+                name = m.group('name').strip()
+                year = m.group('year')
+            else:
+                year_match = re.search(r"(\d{4})", title)
+                year = year_match.group(1) if year_match else ""
+                name = re.sub(r"\(\d{4}\)", "", title).strip()
+
+            rows.append({
+                "Watched Date": date,
+                "Name": name,
+                "Year": year
+            })
+
+        import pandas as pd, io
+        rows.reverse()
+        df = pd.DataFrame(rows)
+        csv_str = df.to_csv(index=False)
+
+        user_csvs[user_id] = csv_str
+
+        return jsonify({'success': True, 'message': 'Diary fetched and stored', 'total': len(rows)}), 200
+
+    except Exception as e:
+        print("Error in fetch_diary_from_username:", str(e))
+        return jsonify({'error': 'An internal error occurred'}), 500
+
+
 @api_bp.route('/download-posters', methods=['POST'])
 def download_posters():
     try:
         data = request.get_json()
         selected_posters = data.get('posters', [])
-
-<<<<<<< HEAD
-        print(data)
-
-=======
->>>>>>> 496f9e8f62940d1f3544da6e72b74be07e18bd25
+        
         if not selected_posters:
             return jsonify({'error': 'No posters selected'}), 400
 
diff --git a/src/services/__pycache__/tmdb_service.cpython-312.pyc b/src/services/__pycache__/tmdb_service.cpython-312.pyc
index 2e0cac1..f23a0b5 100644
Binary files a/src/services/__pycache__/tmdb_service.cpython-312.pyc and b/src/services/__pycache__/tmdb_service.cpython-312.pyc differ
diff --git a/src/services/tmdb_service.py b/src/services/tmdb_service.py
index 7593a31..f3b2d48 100644
--- a/src/services/tmdb_service.py
+++ b/src/services/tmdb_service.py
@@ -24,7 +24,7 @@ class TMDBService:
         return None
     
     def get_movie_posters(self, movie_id):
-        url = f"{self.base_url}/movie/{movie_id}/images?include_image_language=en"
+        url = f"{self.base_url}/movie/{movie_id}/images?include_image_language=en,fr,null"
         headers = {
             "accept": "application/json",
             "Authorization": f"Bearer {self.access_token}"