<!--   hpkpEnabled         Should the HTTP Public Key Pinning (HPKP)      -->

  <!--                       header be added to the response? See RFC 7469  -->

  <!--                       for more information on HPKP. [false]          -->

  <!--                                                                      -->

  <!--   hpkpReportOnly      Should a HPKP "report only" header be set      -->

  <!--                       instead of a HPKP "enforcing" header? [false]  -->

  <!--                                                                      -->

  <!--   hpkpMaxAgeSeconds   The max age value that should be used in the   -->

  <!--                       HPKP header. Negative values will be treated   -->

  <!--                       as zero. [0]                                   -->

  <!--                                                                      -->

  <!--   hpkpIncludeSubDomains                                              -->

  <!--                       Should the includeSubDomains parameter be      -->

  <!--                       included in the HPKP header. [false]           -->

  <!--                                                                      -->

  <!--   hpkpReportUri       The URI that should be used in the HPKP        -->

  <!--                       header's report URI directive. []              -->

  <!--                                                                      -->

  <!--   hpkpPins            A comma separated list of values specifying    -->

  <!--                       the HPKP pins. Values must occur in pairs. The -->

  <!--                       first value of each pair is the hash           -->

  <!--                       algorithm, and the second value is a sequence  -->

  <!--                       of Base64 digits representing an according     -->

  <!--                       SPKI fingerprint. Whitespace after each comma  -->

  <!--                       is allowed. If not specified, the directive    -->

  <!--                       will be omitted in the HPKP header. []         -->

  <!--                                                                      -->

    // HPKP

    private static final String HPKP_HEADER_NAME = "Public-Key-Pins";

    private static final String HPKP_RO_HEADER_NAME = "Public-Key-Pins-Report-Only";

    private boolean hpkpEnabled = false;

    private boolean hpkpReportOnly = false;

    private int hpkpMaxAgeSeconds = 0;

    private boolean hpkpIncludeSubDomains = false;

    private String hpkpReportUri = null;

    private String hpkpPins = null;

    private String hpkpHeaderValue;

        // Build HPKP header value

        StringBuilder hpkpValue = new StringBuilder("max-age=");

        hpkpValue.append(hpkpMaxAgeSeconds);

        if (hpkpIncludeSubDomains) {

            hpkpValue.append("; includeSubDomains");

        }

        if (hpkpReportUri != null) {

            hpkpValue.append("; report-uri=\"");

            hpkpValue.append(hpkpReportUri);

            hpkpValue.append("\"");

        }

        if (hpkpPins != null) {

            String[] hpkpPinArray = hpkpPins.split(",\\s*");

            String hpkpHashType, hpkpHashValue;

            for (int i = 0; i < hpkpPinArray.length / 2; i++) {

                hpkpHashType = hpkpPinArray[2 * i];

                hpkpHashValue = hpkpPinArray[2 * i + 1];

                hpkpValue.append("; pin-");

                hpkpValue.append(hpkpHashType);

                hpkpValue.append("");

                hpkpValue.append("=\"");

                hpkpValue.append(hpkpHashValue);

                hpkpValue.append("\"");

            }

        }

        hpkpHeaderValue = hpkpValue.toString();

            // HPKP

            if (hpkpEnabled && request.isSecure()) {

                if (hpkpReportOnly) {

                    httpResponse.setHeader(HPKP_RO_HEADER_NAME, hpkpHeaderValue);

                } else {

                    httpResponse.setHeader(HPKP_HEADER_NAME, hpkpHeaderValue);

                }

            }

    public boolean isHpkpEnabled() {

        return hpkpEnabled;

    }

    public void setHpkpEnabled(boolean hpkpEnabled) {

        this.hpkpEnabled = hpkpEnabled;

    }

    public boolean isHpkpReportOnly() {

        return hpkpReportOnly;

    }

    public void setHpkpReportOnly(boolean hpkpReportOnly) {

        this.hpkpReportOnly = hpkpReportOnly;

    }

    public int getHpkpMaxAgeSeconds() {

        return hpkpMaxAgeSeconds;

    }

    public void setHpkpMaxAgeSeconds(int hpkpMaxAgeSeconds) {

        if (hpkpMaxAgeSeconds < 0) {

            this.hpkpMaxAgeSeconds = 0;

        } else {

            this.hpkpMaxAgeSeconds = hpkpMaxAgeSeconds;

        }

    }

    public boolean isHpkpIncludeSubDomains() {

        return hpkpIncludeSubDomains;

    }

    public void setHpkpIncludeSubDomains(boolean hpkpIncludeSubDomains) {

        this.hpkpIncludeSubDomains = hpkpIncludeSubDomains;

    }

    public String getHpkpReportUri() {

        return this.hpkpReportUri;

    }

    public void setHpkpReportUri(String hpkpReportUri) {

        this.hpkpReportUri = hpkpReportUri;

    }

    public String getHpkpPins() {

        return this.hpkpPins;

    }

    public void setHpkpPins(String hpkpPins) {

        this.hpkpPins = hpkpPins;

    }

      <attribute name="hpkpEnabled" required="false">

        <p>Will an HTTP Public Key Pinning (HPKP) header (either

        <code>Public-Key-Pins</code> or

        <code>Public-Key-Pins-Report-Only</code>) be set on the response for

        secure requests. Any HPKP header already present will be replaced. See

        <a href="http://tools.ietf.org/html/rfc7469">RFC 7469</a> for further

        details of HPKP. If not specified, the default value of

        <code>false</code> will be used.</p>

      </attribute>

      <attribute name="hpkpReportOnly" required="false">

        <p>Will a HPKP "report only" header

        (<code>Public-Key-Pins-Report-Only</code>) be set instead of a HPKP

        "enforcing" header (<code>Public-Key-Pins</code>). If not specified,

        the default value of <code>false</code> will be used.

        </p>

      </attribute>

      <attribute name="hpkpMaxAgeSeconds" required="false">

        <p>The max age value that should be used in the HPKP header. Negative

        values will be treated as zero. If not specified, the default value of

        <code>0</code> will be used.</p>

      </attribute>

      <attribute name="hpkpIncludeSubDomains" required="false">

        <p>Should the includeSubDomains parameter be included in the HSTS

        header. If not specified, the default value of <code>false</code> will

        be used.</p>

      </attribute>

      <attribute name="hpkpReportUri" required="false">

        <p>The URI that should be used in the HPKP header's report URI

        directive (<code>report-uri</code>). If not specified, the directive

        will be omitted in the HPKP header.</p>

      </attribute>

      <attribute name="hpkpPins" required="false">

        <p>A comma separated list of values specifying the HPKP pins. Values

        must occur in pairs. The first value of each pair is the hash

        algorithm (<code>sha256</code>), and the second value is a sequence of

        Base64 digits representing an according SPKI fingerprint. Whitespace

        after each comma is allowed. If not specified, the directive will be

        omitted in the HPKP header.</p>

      </attribute>