{"action":"created","issue":{"url":"https://api.github.com/repos/getsentry/sentry/issues/2165","labels_url":"https://api.github.com/repos/getsentry/sentry/issues/2165/labels{/name}","comments_url":"https://api.github.com/repos/getsentry/sentry/issues/2165/comments","events_url":"https://api.github.com/repos/getsentry/sentry/issues/2165/events","html_url":"https://github.com/getsentry/sentry/issues/2165","id":111085535,"number":2165,"title":"Handle Public-Key-Pinning (HPKP) violation reports","user":{"login":"reedloden","id":352251,"avatar_url":"https://avatars.githubusercontent.com/u/352251?v=3","gravatar_id":"","url":"https://api.github.com/users/reedloden","html_url":"https://github.com/reedloden","followers_url":"https://api.github.com/users/reedloden/followers","following_url":"https://api.github.com/users/reedloden/following{/other_user}","gists_url":"https://api.github.com/users/reedloden/gists{/gist_id}","starred_url":"https://api.github.com/users/reedloden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reedloden/subscriptions","organizations_url":"https://api.github.com/users/reedloden/orgs","repos_url":"https://api.github.com/users/reedloden/repos","events_url":"https://api.github.com/users/reedloden/events{/privacy}","received_events_url":"https://api.github.com/users/reedloden/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"mattrobenolt","id":375744,"avatar_url":"https://avatars.githubusercontent.com/u/375744?v=3","gravatar_id":"","url":"https://api.github.com/users/mattrobenolt","html_url":"https://github.com/mattrobenolt","followers_url":"https://api.github.com/users/mattrobenolt/followers","following_url":"https://api.github.com/users/mattrobenolt/following{/other_user}","gists_url":"https://api.github.com/users/mattrobenolt/gists{/gist_id}","starred_url":"https://api.github.com/users/mattrobenolt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattrobenolt/subscriptions","organizations_url":"https://api.github.com/users/mattrobenolt/orgs","repos_url":"https://api.github.com/users/mattrobenolt/repos","events_url":"https://api.github.com/users/mattrobenolt/events{/privacy}","received_events_url":"https://api.github.com/users/mattrobenolt/received_events","type":"User","site_admin":false},"milestone":null,"comments":6,"created_at":"2015-10-13T01:28:23Z","updated_at":"2015-10-15T20:22:47Z","closed_at":null,"body":"To expand upon the CSP reporting support added in #729 and #2154, would love to have HPKP reporting support as well. This would really make Sentry very useful for handling these reports coming from browsers.\r\n\r\nhttps://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning\r\nhttps://developers.google.com/web/updates/2015/09/HPKP-reporting-with-chrome-46\r\nhttps://tools.ietf.org/html/rfc7469#section-3"},"comment":{"url":"https://api.github.com/repos/getsentry/sentry/issues/comments/148509851","html_url":"https://github.com/getsentry/sentry/issues/2165#issuecomment-148509851","issue_url":"https://api.github.com/repos/getsentry/sentry/issues/2165","id":148509851,"user":{"login":"ScottHelme","id":5352840,"avatar_url":"https://avatars.githubusercontent.com/u/5352840?v=3","gravatar_id":"","url":"https://api.github.com/users/ScottHelme","html_url":"https://github.com/ScottHelme","followers_url":"https://api.github.com/users/ScottHelme/followers","following_url":"https://api.github.com/users/ScottHelme/following{/other_user}","gists_url":"https://api.github.com/users/ScottHelme/gists{/gist_id}","starred_url":"https://api.github.com/users/ScottHelme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ScottHelme/subscriptions","organizations_url":"https://api.github.com/users/ScottHelme/orgs","repos_url":"https://api.github.com/users/ScottHelme/repos","events_url":"https://api.github.com/users/ScottHelme/events{/privacy}","received_events_url":"https://api.github.com/users/ScottHelme/received_events","type":"User","site_admin":false},"created_at":"2015-10-15T20:22:47Z","updated_at":"2015-10-15T20:22:47Z","body":"If there is no valid pin then the policy won't be cached or enforced. This stops you from easily DoSing yourself.\n\n\nI use another subdomain to demonstrate hpkp violations. You can read more here, https://scotthel.me/pkpf\n\n\nPlease excuse my brevity, I'm on mobile.\n\n\n\n\n\nOn Thu, Oct 15, 2015 at 1:03 PM -0700, \"Matt Robenolt\" <notifications@github.com> wrote:\nHey @reedloden, do you have a way to actually test sending a report? I haven't seemed to be able to get Chrome or Firefox to actually send one to the `report-uri`.\n\nI've added a `Public-Key-Pins` header with a bad `pin-sha265` value (assuming this will cause it to trigger), with a `report-uri`, and I don't get anything. :(\n\n---\nReply to this email directly or view it on GitHub:\nhttps://github.com/getsentry/sentry/issues/2165#issuecomment-148505760\n"}}