hpkp

HTTP Public Key Pinning (HPKP) middleware

Adds Public Key Pinning headers to Express/Connect applications. To learn more about HPKP, check out the spec, the article on MDN, and this tutorial.

Usage:

var express = require('express');
var hpkp = require('hpkp');

var app = express();

var ninetyDaysInMilliseconds = 7776000000;
app.use(hpkp({
  maxAge: ninetyDaysInMilliseconds,
  sha256s: ['AbCdEf123=', 'ZyXwVu456='],
  includeSubdomains: true,         // optional
  reportUri: 'http://example.com'  // optional
}));

Specifying a report-uri changes the header from Public-Key-Pins to Public-Key-Pins-Report-Only. To reverse this, set another option: reportOnly: false. This behavior will change in the 1.0 release.