Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Deprecate HPKP security header

Browse Source 
Closes gh-10144
This commit is contained in:
Marcus Da Coregio
2022-10-03 11:15:21 -03:00
parent 7be2eb05d5
commit 64a19de4dc
6 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/src/main/resources/org/springframework/security/config/spring-security-5.8.rnc
View File

@@ -1193,6 +1193,7 @@ cors-options.attlist &=
attribute configuration-source-ref {xsd:token}?
hpkp =
## Deprecated. The HPKP header no longer works in modern browsers, see <a href="https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning">Certificate and Public Key Pinning</a> for more context
## Adds support for HTTP Public Key Pinning (HPKP).
element hpkp {hpkp.pins,hpkp.attlist}
hpkp.pins =

7
config/src/main/resources/org/springframework/security/config/spring-security-5.8.xsd
View File

@@ -3373,7 +3373,10 @@
</xs:attributeGroup>
<xs:element name="hpkp">
<xs:annotation>
<xs:documentation>Adds support for HTTP Public Key Pinning (HPKP).
<xs:documentation>Deprecated. The HPKP header no longer works in modern browsers, see &lt;a
href="https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning"&gt;Certificate
and Public Key Pinning&lt;/a&gt; for more context Adds support for HTTP Public Key Pinning
(HPKP).
</xs:documentation>
</xs:annotation>
<xs:complexType>
@@ -3875,4 +3878,4 @@
<xs:enumeration value="LAST"/>
</xs:restriction>
</xs:simpleType>
</xs:schema>
</xs:schema>