Sec-Private-State-Token-Crypto-Version header
Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.
The HTTP Sec-Private-State-Token-Crypto-Version Fetch Metadata Request Header is used by the Private State Token API during token issuance to indicate to the issuer server which cryptographic protocol version should be used to sign blinded nonces when generating tokens.
At the time of writing, there is only one version supported, but this mechanism makes it possible to support multiple versions in the future.
Note that a developer wouldn't be expected to generate Sec-Private-State-Token-Crypto-Version request headers — these are created automatically by the browser when invoking private state token token-request fetch requests.
| Header type | Fetch Metadata Request Header |
|---|---|
| Forbidden request header | Yes (Sec- prefix) |
| CORS-safelisted request header | No |
Syntax
Sec-Private-State-Token-Crypto-Version: <string>
Servers should ignore this header if it contains any other value.
Directives
<string>-
A string containing the cryptographic protocol version that should be used by the issuer server to sign blinded nonces when generating tokens.
Examples
Sec-Private-State-Token-Crypto-Version: PrivateStateTokenV1VOPRF
Specifications
| Specification |
|---|
| Private State Token API # sec-private-state-token-crypto-version |
Browser compatibility
| desktop | mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
Sec-Private-State-Token-Crypto-Version
|
|
|
|
|
|
|
|
|
|
|
|
|
Legend
Tip: you can click/tap on a cell for more information.
- Full support
- Full support
- No support
- No support
- Experimental. Expect behavior to change in the future.