MDN wants to talk to developers like you: https://qsurvey.mozilla.com/s3/a3e7b5301fea

Public-Key-Pins

这篇翻译不完整。请帮忙从英语翻译这篇文章

Public-Key-Pins 是一个响应首部,其中含有该 Web 服务器用来进行加密的 public key (公钥) ,以此来降低被使用伪造的证书进行 MITM  (中间人攻击)的风险。假如在其中指定了一个或多个秘钥,但是没有一个属于该服务器,那么浏览器将会认定响应不合法,并且不会将其展示给用户。

更多相关信息请参考 HTTP Public Key Pinning 这篇文章。

Header type Response header
Forbidden header name no

语法

Public-Key-Pins: pin-sha256="<pin-value>"; 
                 max-age=<expire-time>; 
                 includeSubDomains; 
                 report-uri="<uri>"

指令

pin-sha256="<pin-value>"
The quoted string is the Base64 encoded Subject Public Key Information (SPKI) fingerprint. It is possible to specify multiple pins for different public keys. Some browsers might allow other hashing algorithms than SHA-256 in the future.
max-age=<expire-time>
The time, in seconds, that the browser should remember that this site is only to be accessed using one of the defined keys.
includeSubDomains 可选
If this optional parameter is specified, this rule applies to all of the site's subdomains as well.
report-uri="<uri>" 可选
If this optional parameter is specified, pin validation failures are reported to the given URL.

示例

HPKP has the potential to lock out users for a long time if used incorrectly! The use of backup certificates and/or pinning the CA certificate is recommend.

Public-Key-Pins: 
  pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="; 
  pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; 
  max-age=5184000; includeSubDomains; 
  report-uri="https://www.example.org/hpkp-report"

In this example, pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=" pins the server's public key used in production. The second pin declaration pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=" also pins the backup key. max-age=5184000 tells the client to store this information for two months, which is a reasonable time limit according to the IETF RFC. This key pinning is also valid for all subdomains, which is told by the includeSubDomains declaration. Finally, report-uri="https://www.example.org/hpkp-report" explains where to report pin validation failures.

规范

Specification Title
RFC 7469, section 2.1: Public-Key-Pins Public Key Pinning Extension for HTTP

浏览器兼容性

FeatureChromeFirefoxEdgeInternet ExplorerOperaSafari
Basic Support(Yes)35.0(No)1?(Yes)?
report-uri46(No)2??33?
FeatureAndroidChrome for AndroidEdge mobileFirefox for AndroidIE mobileOpera AndroidiOS Safari
Basic Support(Yes)(Yes)?35.0?(Yes)?
report-uri(Yes)(Yes)?(No)?33?

1. Under consideration for future release.

2. See Bugzilla bug 1091176.

相关内容

文档标签和贡献者

 此页面的贡献者: WayneCui
 最后编辑者: WayneCui,