Revision 1148108 of Public-Key-Pins

<div>{{HTTPSidebar}}</div>

<p>The HTTP <code><strong>Public-Key-Pins</strong></code> response header associates a specific cryptographic public {{glossary('key')}} with a certain web server to decrease the risk of {{Glossary("MITM")}} attacks with forged certificates. If one or several keys are pinned and none of them are used by the server, the browser will not accept the response as legitimate, and will not display it.</p>

<p>For more information, see the <a href="/en-US/docs/Web/HTTP/Public_Key_Pinning">HTTP Public Key Pinning</a> article.</p>

<table class="properties">
 <tbody>
  <tr>
   <th scope="row">Header type</th>
   <td>{{Glossary("Response header")}}</td>
  </tr>
  <tr>
   <th scope="row">{{Glossary("Forbidden header name")}}</th>
   <td>no</td>
  </tr>
 </tbody>
</table>

<h2 id="Syntax">Syntax</h2>

<pre class="syntaxbox">
Public-Key-Pins: pin-sha256="&lt;pin-value&gt;"; 
                 max-age=&lt;expire-time&gt;; 
                 includeSubDomains; 
                 report-uri="&lt;uri&gt;"</pre>

<h2 id="Directives">Directives</h2>

<dl>
 <dt><code>pin-sha256="&lt;pin-value&gt;"</code></dt>
 <dd>The quoted string is the Base64 encoded Subject Public Key Information ({{Glossary("SPKI")}}) fingerprint. It is possible to specify multiple pins for different public keys. Some browsers might allow other hashing algorithms than SHA-256 in the future.</dd>
 <dt>max-age=&lt;expire-time&gt;</dt>
 <dd>The time, in seconds, that the browser should remember that this site is only to be accessed using one of the defined keys.</dd>
 <dt><code>includeSubDomains </code>{{optional_inline}}</dt>
 <dd>If this optional parameter is specified, this rule applies to all of the site's subdomains as well.</dd>
 <dt><code>report-uri="&lt;uri&gt;"</code> {{optional_inline}}</dt>
 <dd>If this optional parameter is specified, pin validation failures are reported to the given URL.</dd>
</dl>

<h2 id="Example">Example</h2>

<div class="warning">
<p id="HPKP_has_the_potential_to_lock_out_users_for_a_long_time_if_used_incorrectly!_The_use_of_backup_certificates_andor_pinning_the_CA_certificate_is_recommend.">HPKP has the potential to lock out users for a long time if used incorrectly! The use of backup certificates and/or pinning the CA certificate is recommend.</p>
</div>

<pre>
Public-Key-Pins: 
  pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="; 
  pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; 
  max-age=5184000; includeSubDomains; 
  report-uri="https://www.example.org/hpkp-report"</pre>

<p>In this example, <strong>pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="</strong> pins the server's public key used in production. The second pin declaration <strong>pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="</strong> also pins the backup key. <strong>max-age=5184000</strong> tells the client to store this information for two months, which is a reasonable time limit according to the IETF RFC. This key pinning is also valid for all subdomains, which is told by the <strong>includeSubDomains</strong> declaration. Finally, <strong>report-uri="https://www.example.org/hpkp-report"</strong> explains where to report pin validation failures.</p>

<h2 id="Specifications">Specifications</h2>

<table class="standard-table">
 <tbody>
  <tr>
   <th scope="col">Specification</th>
   <th scope="col">Title</th>
  </tr>
  <tr>
   <td>{{RFC("7469", "Public-Key-Pins", "2.1")}}</td>
   <td>Public Key Pinning Extension for HTTP</td>
  </tr>
 </tbody>
</table>

<h2 id="Browser_compatibility">Browser compatibility</h2>

<p class="hidden">The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out <a href="https://github.com/mdn/browser-compat-data">https://github.com/mdn/browser-compat-data</a> and send us a pull request.</p>

<p>{{Compat("http/headers/public-key-pins", "Public-Key-Pins")}}</p>

<h2 id="See_also">See also</h2>

<ul>
 <li>{{HTTPHeader("Public-Key-Pins-Report-Only")}}</li>
</ul>