1630038 - remove HPKP (http public key pinning) entirely (not built-in pins)

Status: RESOLVED FIXED

(Core :: Security: PSM, task, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

HPKP is disabled by default (bug 1412438). Due to socket process work, it has already become a maintenance burden (see bug 1485652). This bug will remove HPKP entirely. (NB: HPKP refers to "http public key pinning", which is the ability to set pins via a http header. Static pins shipped with the browser will not be affected by this.)

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1630038 - remove HPKP entirely r?kjacobs!,bbeurdouche!

This removes processing of HTTP Public Key Pinning headers, remotely modifying
pinning information, and using cached pinning information, all of which was
already disabled in bug 1412438. Static pins that ship with the browser are
still enforced.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/924f613d68ab
remove HPKP entirely r=kjacobs,bbeurdouche

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/924f613d68ab