Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

hpkp

Package Overview
Dependencies
Maintainers
1
Versions
11
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

hpkp

HTTP Public Key Pinning (HPKP) middleware

  • 3.0.0
  • latest
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
411K
decreased by-5.92%
Maintainers
1
Weekly downloads
 
Created
Source

HTTP Public Key Pinning (HPKP) middleware

This header has been deprecated citing risks of misuse, and therefore is not recommeded. This module (hpkp) will not receive any new feature development but will still be maintained.

Adds Public Key Pinning headers to Express/Connect applications. To learn more about HPKP, check out the spec, the article on MDN, and this tutorial.

Be very careful when deploying this—you can easily misuse this header and cause problems. Chrome has dropped support for HPKP citing risks of misuse.

Usage:

const express = require("express");
const hpkp = require("hpkp");

const app = express();

const ninetyDaysInSeconds = 7776000;
app.use(
  hpkp({
    maxAge: ninetyDaysInSeconds,
    sha256s: ["AbCdEf123=", "ZyXwVu456="],
    includeSubDomains: true, // optional
    reportUri: "https://example.com", // optional
    reportOnly: false, // optional

    // Set the header based on a condition.
    // This is optional.
    setIf(req, res) {
      return req.secure;
    },
  }),
);

Setting reportOnly to true will change the header from Public-Key-Pins to Public-Key-Pins-Report-Only.

Don't let these get out of sync with your certs! It's also recommended to test your HPKP deployment in reportOnly mode, or alternatively, to use a very short maxAge until you're confident your deployment is correct.

Keywords

FAQs

Package last updated on 10 Oct 2024

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc