I volontari di MDN non hanno ancora tradotto questo articolo in Italiano. Unisciti a noi e traducilo tu stesso.
Puoi anche consultare l’articolo in English (US).

The HTTP Public-Key-Pins-Report-Only response header sends reports of pinning violation to the report-uri specified in the header but, unlike Public-Key-Pins still allows browsers to connect to the server if the pinning is violated.

For more information, see the Public-Key-Pins header reference page and the HTTP Public Key Pinning article.

Header type Response header
Forbidden header name no

Syntax

Public-Key-Pins-Report-Only: pin-sha256="<pin-value>"; 
                             max-age=<expire-time>; 
                             includeSubDomains; 
                             report-uri="<uri>"

Directives

pin-sha256="<pin-value>"
The quoted string is the Base64 encoded Subject Public Key Information (SPKI) fingerprint. It is possible to specify multiple pins for different public keys. Some browsers might allow other hashing algorithms than SHA-256 in the future.
max-age=<expire-time>
This directive is meaningless for the Public-Key-Pins-Report-Only header, it will be ignored by user agents and the header will not be cached.
includeSubDomains Optional
If this optional parameter is specified, this rule applies to all of the site's subdomains as well.
report-uri="<uri>"
Pin validation failures are reported to the given URL. This directive should be used with this header, otherwise this header will be a no-op.

Example

Public-Key-Pins-Report-Only: 
  pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="; 
  pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; 
  includeSubDomains; 
  report-uri="https://www.example.org/hpkp-report"

In this example, pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=" pins the server's public key used in production. The second pin declaration pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=" also pins the backup key. This key pinning is also valid for all subdomains, which is told by the includeSubDomains declaration. Finally, report-uri="https://www.example.org/hpkp-report" explains where to report pin validation failures.

Specifications

Specification Title
RFC 7469, section 2.1: Public-Key-Pins-Report-Only Public Key Pinning Extension for HTTP

Browser compatibility

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidEdge MobileFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
Basic supportChrome Full support 46Edge No support No
Notes
No support No
Notes
Notes Under consideration for future release.
Firefox No support No
Notes
No support No
Notes
Notes See bug 1091177.
IE ? Opera Full support 33Safari ? WebView Android Full support YesChrome Android Full support YesEdge Mobile ? Firefox Android No support NoOpera Android Full support 33Safari iOS ? Samsung Internet Android Full support Yes

Legend

Full support  
Full support
No support  
No support
Compatibility unknown  
Compatibility unknown
See implementation notes.
See implementation notes.

See also

Tag del documento e collaboratori

Hanno collaborato alla realizzazione di questa pagina: fscholz, raulsiles, arlenyan, teoli
Ultima modifica di: fscholz,