Subject: [websec] Public-Key-Pins-Report-Only

From: Trevor Perrin <[email-masked]>
Date: Fri, 21 Feb 2014 00:24:28 -0800

Hi websec,

How should HPKP's Public-Key-Pins-Report-Only header work?

Does it only apply a check to the current TLS connection, or is the UA
is expected to remember the pins and apply them to future connections?

If the UA is expected to remember them, how do "Report-Only" pins
interact with regular pins?  Do they override each other or are
Report-Only pins tracked separately, so that a browser might have a
Report-Only pin and a "regular" pin for the same site?

Trevor