diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index fec80c94ea..3248a7c774 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -2121,10 +2121,6 @@ pref("security.mixed_content.block_display_content", false); // Disable pinning checks by default. pref("security.cert_pinning.enforcement_level", 0); -// Do not process hpkp headers rooted by not built in roots by default. -// This is to prevent accidental pinning from MITM devices and is used -// for tests. -pref("security.cert_pinning.process_headers_from_non_builtin_roots", false); // Modifier key prefs: default to Windows settings, // menu access key = alt, accelerator key = control. diff --git a/security/manager/boot/src/nsSiteSecurityService.cpp b/security/manager/boot/src/nsSiteSecurityService.cpp index b5a9ac3943..2876de74ad 100644 --- a/security/manager/boot/src/nsSiteSecurityService.cpp +++ b/security/manager/boot/src/nsSiteSecurityService.cpp @@ -249,10 +249,6 @@ nsSiteSecurityService::Init() "network.stricttransportsecurity.enabled", true); mozilla::Preferences::AddStrongObserver(this, "network.stricttransportsecurity.enabled"); - mProcessPKPHeadersFromNonBuiltInRoots = mozilla::Preferences::GetBool( - "security.cert_pinning.process_headers_from_non_builtin_roots", false); - mozilla::Preferences::AddStrongObserver(this, - "security.cert_pinning.process_headers_from_non_builtin_roots"); mPreloadListTimeOffset = mozilla::Preferences::GetInt( "test.currentTimeOffsetSeconds", 0); mozilla::Preferences::AddStrongObserver(this, @@ -706,10 +702,6 @@ nsSiteSecurityService::ProcessPKPHeader(nsIURI* aSourceURI, return NS_ERROR_FAILURE; } - if (!isBuiltIn && !mProcessPKPHeadersFromNonBuiltInRoots) { - return NS_OK; - } - // if maxAge == 0 we must delete all state, for now no hole-punching if (maxAge == 0) { return RemoveState(aType, aSourceURI, aFlags); @@ -1128,8 +1120,6 @@ nsSiteSecurityService::Observe(nsISupports *subject, "network.stricttransportsecurity.preloadlist", true); mPreloadListTimeOffset = mozilla::Preferences::GetInt("test.currentTimeOffsetSeconds", 0); - mProcessPKPHeadersFromNonBuiltInRoots = mozilla::Preferences::GetBool( - "security.cert_pinning.process_headers_from_non_builtin_roots", false); } return NS_OK;