I'm trying to learn about HPKP and I am trying to grasp if it is just a level of protection for user agents to mitigate MiTM attacks over HTTPS or if the server also plays a role.

Please keep in mind I am literally just learning, reading, googling about this now so the proceeding question details may use terms and concepts incorrectly. For the sake of my own education, and others that may come after me to this question with the same limited information, please feel free to alleviate my/their ignorance.

So as I currently understand it, the server delivers the relevant HPKP headers to the user agent. It is then up to the agent alone, such as a web browser, to enforce it. It does not appear that there is any validation happening on the server.

In other words, I could write a custom client that completely ignores the Pinning header details. Sure it would receive the headers, but my custom client is free to make HTTPS requests any way it sees fit (within the bounds of HTTPS protocol). Obviously I would be putting my imaginary users at risk to ignore this information.

With no server verification in place though I am completely free to just skip it and everything will proceed normally.

To summarize, HPKP seems to be a user agent bound feature, not a server bound feature along the same lines as HSTS. They are response headers that tell the agent: "Hey, please do this, but it's really up to you". If I am the author of a responsible user agent, and I care about my users security, I will make my user agent comply. Compliance however is optional.


Yes, both HSTS and HPKP are enforced by the client/user agent. All that the server does is generate response headers.

The server cannot enforce compliance because, in a MITM/interception scenario, the server might not even be involved at all to enforce the policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.