Deprecated
This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.
Expect-CT
header.The HTTP Public-Key-Pins-Report-Only
response header was used to send reports of pinning violation to the report-uri
specified in the header but, unlike Public-Key-Pins
still allows browsers to connect to the server if the pinning is violated. The header is silently ignored in modern browsers as support for HPKP has been removed. Use Certificate Transparency and the Expect-CT
header instead.
For more information, see the Public-Key-Pins
header reference page and the HTTP Public Key Pinning article.
Header type | Response header |
---|---|
Forbidden header name | no |
Syntax
Public-Key-Pins-Report-Only: pin-sha256="<pin-value>"; max-age=<expire-time>; includeSubDomains; report-uri="<uri>"
Directives
pin-sha256="<pin-value>"
- The quoted string is the Base64 encoded Subject Public Key Information (SPKI) fingerprint. It is possible to specify multiple pins for different public keys. Some browsers might allow other hashing algorithms than SHA-256 in the future.
- max-age=<expire-time>
- This directive is meaningless for the Public-Key-Pins-Report-Only header, it will be ignored by user agents and the header will not be cached.
includeSubDomains
Optional- If this optional parameter is specified, this rule applies to all of the site's subdomains as well.
report-uri="<uri>"
- Pin validation failures are reported to the given URL. This directive should be used with this header, otherwise this header will be a no-op.
Example
Public-Key-Pins-Report-Only: pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="; pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; includeSubDomains; report-uri="https://www.example.org/hpkp-report"
In this example, pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=" pins the server's public key used in production. The second pin declaration pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=" also pins the backup key. This key pinning is also valid for all subdomains, which is told by the includeSubDomains declaration. Finally, report-uri="https://www.example.org/hpkp-report" explains where to report pin validation failures.
Specifications
Specification | Title |
---|---|
RFC 7469, section 2.1: Public-Key-Pins-Report-Only | Public Key Pinning Extension for HTTP |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Public-Key-Pins-Report-Only | Chrome No support 46 — 72 | Edge No support No | Firefox
No support
No
| IE No support No | Opera No support 33 — 60 | Safari No support No | WebView Android No support No | Chrome Android No support ? — 72 | Firefox Android No support No | Opera Android No support 33 — 51 | Safari iOS No support No | Samsung Internet Android No support 5.0 — 11.0 |
Legend
- No support
- No support
- Deprecated. Not for use in new websites.
- Deprecated. Not for use in new websites.
- See implementation notes.
- See implementation notes.