hpkp
    Overview
    Documentation
    Insights
    Code
    Contributors
    Dependencies
    Alternatives

hpkp

HTTP Public Key Pinning (HPKP) middleware

2.0.0  •  Published 3 years ago  •  by helmetjs  •  MIT License

HTTP Public Key Pinning (HPKP) middleware

Build Status js-standard-style

Looking for a changelog?

Adds Public Key Pinning headers to Express/Connect applications. To learn more about HPKP, check out the spec, the article on MDN, and this tutorial.

Usage:

var express = require('express')
var hpkp = require('hpkp')

var app = express()

var ninetyDaysInSeconds = 7776000
app.use(hpkp({
  maxAge: ninetyDaysInSeconds,
  sha256s: ['AbCdEf123=', 'ZyXwVu456='],
  includeSubDomains: true,         // optional
  reportUri: 'http://example.com', // optional
  reportOnly: false,               // optional

  // Set the header based on a condition.
  // This is optional.
  setIf: function (req, res) {
    return req.secure
  }
}))

Setting reportOnly to true will change the header from Public-Key-Pins to Public-Key-Pins-Report-Only.

Don’t let these get out of sync with your certs! It’s also recommended to test your HPKP deployment in reportOnly mode, or alternatively, to use a very short maxAge until you’re confident your deployment is correct.

How do you feel about the name Devstore for this site?

Popularity

Weekly Downloads
607.0K
Stars
28

Maintenance

Development

Last ver 3 years ago
Created 5 years ago
Last commit 3 months ago
25 days between commits

Technology

Node version: 7.0.0
0 unpacked

Compliance

MIT License
OSI Approved
0 vulnerabilities

Contributors

6 contributors
Evan Hahn
Maintainer, 62 commits, 5 merges
Works at Airtable
Drew Folta
1 commits, 1 PRs
Benno van den Berg
1 commits, 1 PRs
Works at wercker
Tom
1 commits, 2 PRs
Timofey Dergachev
1 commits, 1 PRs
Works at Upsilon
dependabot[bot]
1 commits

Tags

helmet
security
express
connect
public-key pinning
https
cert
certificate
Ready for the next level?
Join Devstore's founding team to help us build the ultimate open-source app store, work with the latest technologies, and enjoy great culture, impact and autonomy
© 2019 Devstore, Inc.
Devstore helps developers find and use open-source packages, so they can focus on building amazing things