Public-Key-Pins-Report-Only

HTTP响应头部Public-Key-Pins-Report-Only用于设置在公钥固定不匹配时,发送错误信息到report-uri。 但和Public-Key-Pins不同的是,即便公钥固定异常, 其允许浏览器继续访问服务器。

 

更多信息可以查看Public-Key-Pins参考页面和HTTP Public Key Pinning文章

 

Header type Response header
Forbidden header name no

语法

Public-Key-Pins-Report-Only: pin-sha256="<pin-value>"; 
                             max-age=<expire-time>; 
                             includeSubDomains; 
                             report-uri="<uri>"

指令

pin-sha256="<pin-value>"
引号里面的是内容是以Base64编码的 SPKI(公钥) 指纹。你可以为多个不同的公钥都设定对应的pins。 一些浏览器将来可能也支持非SHA-256 的哈希算法。
max-age=<expire-time>
该指令对 Public-Key-Pins-Report-Only无效,客户端会忽略也不会缓存此头部。
 
includeSubDomains 可选
如果该选项被指定,该规则也会应用到网站的所有子域名
report-uri="<uri>"

     设置Pin验证失败报告的URL地址。这个指令应该和该头部一起使用,否则这个头部将是一个空操作。

 

例子

Public-Key-Pins-Report-Only: 
  pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="; 
  pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; 
  includeSubDomains; 
  report-uri="https://www.example.org/hpkp-report"

在这个例子里面,pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=" 固定了该服务器的公钥.。第二个声明pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=" 也固定了服务器的备用公钥。同时通过includeSubDomains 的声明使得该设置对所有子域名都生效。最后, report-uri="https://www.example.org/hpkp-report" 则是定义了在验证失败时将异常信息发送到该服务器。

标准

Specification Title
RFC 7469, section 2.1: Public-Key-Pins-Report-Only Public Key Pinning Extension for HTTP

浏览器兼容

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidEdge MobileFirefox for AndroidOpera for AndroidiOS SafariSamsung Internet
Basic supportChrome Full support 46Edge No support No
Notes
No support No
Notes
Notes Under consideration for future release.
Firefox No support No
Notes
No support No
Notes
Notes See bug 1091177.
IE ? Opera Full support 33Safari ? WebView Android Full support YesChrome Android Full support YesEdge Mobile ? Firefox Android No support NoOpera Android Full support 33Safari iOS ? Samsung Internet Android Full support Yes

Legend

Full support  
Full support
No support  
No support
Compatibility unknown  
Compatibility unknown
See implementation notes.
See implementation notes.

更多

文档标签和贡献者

标签: 
此页面的贡献者: ujsxn, shevacjs
最后编辑者: ujsxn,