deprecate(security-reports): Remove reference to Expect-CT and HPKP (#13853)

armenzg · web-flow · commit 6a6e4d2d0e6a · 2025-05-29T12:43:50.000-07:00
These reports have been removed by Chrome a while ago: - **Expect-CT** was removed in [Chrome 107](https://chromestatus.com/feature/6244547273687040), and Firefox never implemented support - **HPKP** was removed in [Chrome 72](https://chromestatus.com/feature/5903385005916160) and [Firefox 72](https://groups.google.com/g/mozilla.dev.platform/c/AyMlrNHYepE/m/B5bgjjsiBwAJ) (not a typo) We will need to follow up with a pull request to remove it from the code base.
diff --git a/develop-docs/sdk/expected-features/rate-limiting.mdx b/develop-docs/sdk/expected-features/rate-limiting.mdx
@@ -88,7 +88,7 @@ While these [data categories](https://github.com/getsentry/relay/blob/master/rel
   - `error`: Error events.
   - `transaction`: Transaction type events.
   - `span`: Span type events.
-  - `security`: Events with event_type `csp`, `hpkp`, `expectct`, `expectstaple`
+  - `security`: Events with event_type `csp`
   - `attachment`: Attachment bytes stored (unused for rate limiting)
   - `session`: Session update events
   - `profile`: Profiling events
diff --git a/docs/platforms/dotnet/common/security-policy-reporting/index.mdx b/docs/platforms/dotnet/common/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/elixir/security-policy-reporting/index.mdx b/docs/platforms/elixir/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/go/common/security-policy-reporting/index.mdx b/docs/platforms/go/common/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/java/common/security-policy-reporting/index.mdx b/docs/platforms/java/common/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/javascript/common/security-policy-reporting/index.mdx b/docs/platforms/javascript/common/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/native/common/security-policy-reporting/index.mdx b/docs/platforms/native/common/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/php/common/security-policy-reporting/index.mdx b/docs/platforms/php/common/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/python/security-policy-reporting/index.mdx b/docs/platforms/python/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/ruby/common/security-policy-reporting/index.mdx b/docs/platforms/ruby/common/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/docs/platforms/rust/common/security-policy-reporting/index.mdx b/docs/platforms/rust/common/security-policy-reporting/index.mdx
@@ -2,7 +2,7 @@
 title: Set Up Security Policy Reporting
 sidebar_title: Security Policy Reporting
 sidebar_order: 7500
-description: "Learn how Sentry can help manage Content-Security-Policy violations, CSP reports, Expect-CT, and HTTP Public Key Pinning (HPKP) failures here."
+description: "Learn how Sentry can help manage Content-Security-Policy violations and reports here."
 ---
 
 <Include name="platforms/security-policy-reporting/content.mdx" />
diff --git a/includes/platforms/security-policy-reporting/content.mdx b/includes/platforms/security-policy-reporting/content.mdx
@@ -1,4 +1,4 @@
-Sentry provides the ability to collect information on [Content-Security-Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) violations, as well as [Expect-CT](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT) and [HTTP Public Key Pinning (HPKP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning) failures by setting the proper HTTP header which results in the violation or failure to be sent to Sentry endpoint specified in _report-uri_.
+Sentry provides the ability to collect information on [Content-Security-Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) violations by setting the proper HTTP header which results in the violation to be sent to Sentry endpoint specified in _report-uri_.
 
 The integration process consists of configuring the appropriate header with your project key’s Security Header endpoint found at **Project Settings > Security Headers**.
 
@@ -40,31 +40,6 @@ When defining your policy it is important to ensure that `sentry.io` or your sel
 
 For more information, see the article on [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).
 
-## Expect-CT
-
-[Certificate Transparency](https://en.wikipedia.org/wiki/Certificate_Transparency) (CT) is a security standard that helps track and identify valid certificates, allowing identification of maliciously issued certificates.
-
-To configure reports in Sentry, you’ll need to configure the Expect-CT header from your server:
-
-
-```
-Expect-CT: ..., report-uri="https://___ORG_INGEST_DOMAIN___/api/___PROJECT_ID___/security/?sentry_key=___PUBLIC_KEY___"
-```
-
-For more information, see the article on [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT).
-
-## HTTP Public Key Pinning
-
-[HTTP Public Key Pinning](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning) (HPKP) is a security feature that tells a web client to associate a specific cryptographic public key with a certain web server to decrease the risk of MITM attacks with forged certificates. It’s enforced by browser vendors, and Sentry supports capturing violations using the standard reporting hooks.
-
-To configure HPKP reports in Sentry, you’ll need to send a header from your server describing your policy and specify the authenticated Sentry endpoint:
-
-
-```
-Public-Key-Pins: ...; report-uri="https://___ORG_INGEST_DOMAIN___/api/___PROJECT_ID___/security/?sentry_key=___PUBLIC_KEY___"
-```
-
-For more information, see the article on [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning).
 
 ## Additional Configuration
 
diff --git a/src/data/relay_event_pii.json b/src/data/relay_event_pii.json
@@ -43,22 +43,10 @@
     "path": "Event.exceptions.stacktrace.frames.vars",
     "additional_properties": false
   },
-  {
-    "path": "Event.expectct",
-    "additional_properties": false
-  },
-  {
-    "path": "Event.expectstaple",
-    "additional_properties": false
-  },
   {
     "path": "Event.extra",
     "additional_properties": false
   },
-  {
-    "path": "Event.hpkp",
-    "additional_properties": false
-  },
   {
     "path": "Event.logentry.params",
     "additional_properties": false
