Наші добровольці ще не переклали статтю цією мовою: Українська. Долучайтеся й допоможіть це зробити!
Ви також можете прочитати цю статтю іншою мовою: English (US).

The HTTP Public-Key-Pins response header associates a specific cryptographic public key with a certain web server to decrease the risk of MITM attacks with forged certificates. If one or several keys are pinned and none of them are used by the server, the browser will not accept the response as legitimate, and will not display it.

For more information, see the HTTP Public Key Pinning article.

Header type Response header
Forbidden header name no

Syntax

Public-Key-Pins: pin-sha256="<pin-value>"; 
                 max-age=<expire-time>; 
                 includeSubDomains; 
                 report-uri="<uri>"

Directives

pin-sha256="<pin-value>"
The quoted string is the Base64 encoded Subject Public Key Information (SPKI) fingerprint. It is possible to specify multiple pins for different public keys. Some browsers might allow other hashing algorithms than SHA-256 in the future.
max-age=<expire-time>
The time, in seconds, that the browser should remember that this site is only to be accessed using one of the defined keys.
includeSubDomains Optional
If this optional parameter is specified, this rule applies to all of the site's subdomains as well.
report-uri="<uri>" Optional
If this optional parameter is specified, pin validation failures are reported to the given URL.

Example

HPKP has the potential to lock out users for a long time if used incorrectly! The use of backup certificates and/or pinning the CA certificate is recommend.

Public-Key-Pins: 
  pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="; 
  pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; 
  max-age=5184000; includeSubDomains; 
  report-uri="https://www.example.org/hpkp-report"

In this example, pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=" pins the server's public key used in production. The second pin declaration pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=" also pins the backup key. max-age=5184000 tells the client to store this information for two months, which is a reasonable time limit according to the IETF RFC. This key pinning is also valid for all subdomains, which is told by the includeSubDomains declaration. Finally, report-uri="https://www.example.org/hpkp-report" explains where to report pin validation failures.

Specifications

Specification Title
RFC 7469, section 2.1: Public-Key-Pins Public Key Pinning Extension for HTTP

Browser compatibility

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidEdge MobileFirefox for AndroidOpera for AndroidiOS SafariSamsung Internet
Basic supportChrome Full support YesEdge No support No
Notes
No support No
Notes
Notes Under consideration for future release.
Firefox Full support 35IE ? Opera Full support YesSafari ? WebView Android Full support YesChrome Android Full support YesEdge Mobile ? Firefox Android Full support 35Opera Android Full support YesSafari iOS ? Samsung Internet Android Full support Yes
report-uriChrome Full support 46Edge ? Firefox No support No
Notes
No support No
Notes
Notes See bug 1091176.
IE ? Opera Full support 33Safari ? WebView Android Full support YesChrome Android Full support YesEdge Mobile ? Firefox Android No support NoOpera Android Full support 33Safari iOS ? Samsung Internet Android Full support Yes

Legend

Full support  
Full support
No support  
No support
Compatibility unknown  
Compatibility unknown
See implementation notes.
See implementation notes.

See also

Мітки документа й учасники

Зробили внесок у цю сторінку: jpmedley, fscholz, teoli
Востаннє оновлена: jpmedley,