helmetjs / hpkp Goto Github PK

Deprecated HTTP Public Key Pinning (HPKP) middleware

License: MIT License

JavaScript 100.00%

hpkp

hpkp's Introduction

HTTP Public Key Pinning (HPKP) middleware

This header has been deprecated citing risks of misuse, and therefore is not recommeded. This module (hpkp) will not receive any new feature development but will still be maintained.

Adds Public Key Pinning headers to Express/Connect applications. To learn more about HPKP, check out the spec, the article on MDN, and this tutorial.

Be very careful when deploying this—you can easily misuse this header and cause problems. Chrome has dropped support for HPKP citing risks of misuse.

Usage:

const express = require("express");
const hpkp = require("hpkp");

const app = express();

const ninetyDaysInSeconds = 7776000;
app.use(
  hpkp({
    maxAge: ninetyDaysInSeconds,
    sha256s: ["AbCdEf123=", "ZyXwVu456="],
    includeSubDomains: true, // optional
    reportUri: "https://example.com", // optional
    reportOnly: false, // optional

    // Set the header based on a condition.
    // This is optional.
    setIf(req, res) {
      return req.secure;
    },
  })
);

Setting reportOnly to true will change the header from Public-Key-Pins to Public-Key-Pins-Report-Only.

Don't let these get out of sync with your certs! It's also recommended to test your HPKP deployment in reportOnly mode, or alternatively, to use a very short maxAge until you're confident your deployment is correct.

hpkp's People

Contributors

Stargazers

Watchers

Forkers

tdelmas noscripter

hpkp's Issues

Must require at least two pins, not just one.

To be valid, an HPKP header mush pin :

at least one key of the current certificate chain.
at least one key NOT in the current certificate chain (aka "Backup pin")
So any hpkp header with less than one pin can't be valid

https://tools.ietf.org/html/rfc7469#section-4.3

https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning

Chrome to drop HTTP-Based Public Key Pinning

Chrome is about to drop support for HTTP-Based Public Key Pinning.

https://developers.google.com/web/updates/2018/04/chrome-67-deps-rems

Allowing report-uri for both headers

From the README:

Specifying a report-uri changes the header from Public-Key-Pins to Public-Key-Pins-Report-Only.

That's not ideal, since a report-uri field can be given to either header, and it's useful under both circumstances.

Definitely Typed for TypeScript@next needs a PR for the types-2.0 branch

The upcoming Typescript release will support the new @types/ mechanism, so that .d.ts files can provided via npm install instead of the fragile typings (formerly tsd). For example:

npm install --save-dev @types/helmet

However, @types is using the types-2.0 branch and not the master branch of https://github.com/DefinitelyTyped/DefinitelyTyped:

Unfortunately the PR DefinitelyTyped/DefinitelyTyped#9162 regarding hpkp(...) instead of publicKeyPins(...) is missing in the types-2.0 branch .

result.push('max-age=' + Math.round(options.maxAge / 1001));