diff --git a/src/main/java/com/example/gestionstagesbackend/config/SecurityConfig.java b/src/main/java/com/example/gestionstagesbackend/config/SecurityConfig.java
index 9938c2a7d2ae4147a6e0b1ba8f9349a26eca1aa6..7b9cf037f0ce627f30e479b1ab5584efbc8b875e 100644
--- a/src/main/java/com/example/gestionstagesbackend/config/SecurityConfig.java
+++ b/src/main/java/com/example/gestionstagesbackend/config/SecurityConfig.java
@@ -43,8 +43,8 @@ public class SecurityConfig {
                         .requestMatchers("/**").permitAll()
 
                         // Role-based access
-                        // STUDENTS (ETUDIANTS) - Can ONLY View Students & Stages
-                        .requestMatchers(HttpMethod.GET, "/api/students").hasAuthority("ROLE_ETUDIANT")
+                        // STUDENTS (ETUDIANTS) - Can ONLY View Stages
+                        .requestMatchers(HttpMethod.GET, "/api/stages/**").hasAuthority("ROLE_ETUDIANT")
                         .requestMatchers(HttpMethod.GET, "/api/stages").hasAuthority("ROLE_ETUDIANT")
 
                         // ENTERPRISES - Can CRUD Stages but NOT Students
diff --git a/src/main/java/com/example/gestionstagesbackend/controllers/CandidacyController.java b/src/main/java/com/example/gestionstagesbackend/controllers/CandidacyController.java
index 99034d74077f7cb2118b5fc80d40ff3caa1416c5..933e4a7e1d7666b244ea9b8b4501cf323dd2dfd6 100644
--- a/src/main/java/com/example/gestionstagesbackend/controllers/CandidacyController.java
+++ b/src/main/java/com/example/gestionstagesbackend/controllers/CandidacyController.java
@@ -66,6 +66,9 @@ public class CandidacyController {
         candidacy.setStudent(student.get());
         candidacy.setStage(stage.get());
         univSupervisor.ifPresent(candidacy::setUnivSupervisor);
+        if (candidacy.getComment() == null) {
+            candidacy.setComment(""); // Valeur par défaut si vide
+        }
 
         Candidacy savedCandidacy = candidacyService.saveCandidacy(candidacy);
         return ResponseEntity.ok(savedCandidacy);
@@ -136,6 +139,9 @@ public class CandidacyController {
         if (updatedCandidacy.getAcceptedState() != null) {
             candidacy.setAcceptedState(updatedCandidacy.getAcceptedState());
         }
+        if (updatedCandidacy.getComment() != null) {
+            candidacy.setComment(updatedCandidacy.getComment());
+        }
 
         // Save the updated candidacy
         Candidacy savedCandidacy = candidacyService.saveCandidacy(candidacy);
diff --git a/src/main/java/com/example/gestionstagesbackend/model/Candidacy.java b/src/main/java/com/example/gestionstagesbackend/model/Candidacy.java
index 3b6d2936e94a863eacefda78e3a587382431434f..9f8b90ad6188537429d39e1ca313c5c91abc6d4c 100644
--- a/src/main/java/com/example/gestionstagesbackend/model/Candidacy.java
+++ b/src/main/java/com/example/gestionstagesbackend/model/Candidacy.java
@@ -36,6 +36,9 @@ public class Candidacy {
     // Enum to store the accepted candidacy state (wait, inProgress, terminated)
     @Enumerated(EnumType.STRING)
     private AcceptedCandidacyStateKind acceptedState = AcceptedCandidacyStateKind.wait;
+    // Ajout du champ commentaire
+    @Column(length = 500) // Définit une longueur max
+    private String comment;
 
     public Candidacy() {}
 
@@ -45,6 +48,7 @@ public class Candidacy {
         this.univSupervisor = univSupervisor;
         this.requestState = CandidacyRequestState.FirstRequest; // Default state
         this.acceptedState = AcceptedCandidacyStateKind.wait;  // Default state
+        this.comment = comment;
     }
 
     public Long getId() { return id; }
@@ -65,4 +69,12 @@ public class Candidacy {
     public AcceptedCandidacyStateKind getAcceptedState() { return acceptedState; }
     public void setAcceptedState(AcceptedCandidacyStateKind acceptedState) { this.acceptedState = acceptedState; }
 
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
 }