README.md
HTTP Public Key Pinning (HPKP) middleware
<em>Looking for a changelog?</em>
Adds Public Key Pinning headers to Express/Connect applications. To learn more about HPKP, check out the spec, the article on MDN, and this tutorial.
Usage:
var express = require('express')
var hpkp = require('hpkp')
var app = express()
var ninetyDaysInMilliseconds = 7776000000
app.use(hpkp({
maxAge: ninetyDaysInMilliseconds,
sha256s: ['AbCdEf123=', 'ZyXwVu456='],
includeSubdomains: true, // optional
reportUri: 'http://example.com', // optional
reportOnly: false, // optional
// Set the header based on a condition.
// This is optional.
setIf: function (req, res) {
return req.secure
}
}))
Setting reportOnly to true will change the header from Public-Key-Pins to Public-Key-Pins-Report-Only.