4 ms·
Okay, but I still think mobile app apis served over SSL that don't pin to a specific signer are making their lives way harder.
by KirinDave 9y ago
Okay, but I still think mobile app apis served over SSL that don't pin to a specific signer are making their lives way harder.
- skywhopper 9y agoThis is true. This is an actual case where pinning is a good idea, but this sort of pinning can and should happen in the application code or config, by restricting which CAs are trusted for a particular transaction. There's no need for a generic HTTP header for this situation. Set your TLS negotiation requirements in your app.