Deprecated
This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.
Expect-CT
header.
The HTTP Public-Key-Pins
response header associates a specific cryptographic public key with a certain web server to decrease the risk of MITM attacks with forged certificates. If one or several keys are pinned and none of them are used by the server, the browser will not accept the response as legitimate, and will not display it.
For more information, see the HTTP Public Key Pinning article.
Header type | Response header |
---|---|
Forbidden header name | no |
Syntax
Public-Key-Pins: pin-sha256="<pin-value>"; max-age=<expire-time>; includeSubDomains; report-uri="<uri>"
Directives
pin-sha256="<pin-value>"
- The quoted string is the Base64 encoded Subject Public Key Information (SPKI) fingerprint. It is possible to specify multiple pins for different public keys. Some browsers might allow other hashing algorithms than SHA-256 in the future.
max-age=<expire-time>
- The time, in seconds, that the browser should remember that this site is only to be accessed using one of the defined keys.
includeSubDomains
Optional- If this optional parameter is specified, this rule applies to all of the site's subdomains as well.
report-uri="<uri>"
Optional- If this optional parameter is specified, pin validation failures are reported to the given URL.
Example
HPKP has the potential to lock out users for a long time if used incorrectly! The use of backup certificates and/or pinning the CA certificate is recommended.
Public-Key-Pins: pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="; pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; max-age=5184000; includeSubDomains; report-uri="https://www.example.org/hpkp-report"
In this example, pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=" pins the server's public key used in production. The second pin declaration pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=" also pins the backup key. max-age=5184000 tells the client to store this information for two months, which is a reasonable time limit according to the IETF RFC. This key pinning is also valid for all subdomains, which is told by the includeSubDomains declaration. Finally, report-uri="https://www.example.org/hpkp-report" explains where to report pin validation failures.
Specifications
Specification | Title |
---|---|
RFC 7469, section 2.1: Public-Key-Pins | Public Key Pinning Extension for HTTP |
Browser compatibility
The compatibility table on this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Public-Key-Pins | Chrome No support ? — 72 | Edge
No support
No
| Firefox
No support
35 — 72
| IE No support No | Opera Full support Yes | Safari No support No | WebView Android Full support Yes | Chrome Android No support ? — 72 | Firefox Android Full support 35 | Opera Android Full support Yes | Safari iOS No support No | Samsung Internet Android Full support Yes |
report-uri | Chrome No support 46 — 72 | Edge No support No | Firefox
No support
No
| IE No support No | Opera Full support 33 | Safari No support No | WebView Android Full support Yes | Chrome Android No support ? — 72 | Firefox Android No support No | Opera Android Full support 33 | Safari iOS No support No | Samsung Internet Android Full support Yes |
Legend
- Full support
- Full support
- No support
- No support
- See implementation notes.
- See implementation notes.
- User must explicitly enable this feature.
- User must explicitly enable this feature.