Limit Public-Key-Pins max-age to 60 days

net/http/http_security_headers.h

Index: net/http/http_security_headers.h
diff --git a/net/http/http_security_headers.h b/net/http/http_security_headers.h
index af904307870cf7ba8e637da979139d04c463bfe2..a2ddad2d46e7cb139d28dfa4477b25080f0aea81 100644
--- a/net/http/http_security_headers.h
+++ b/net/http/http_security_headers.h
@@ -20,6 +20,10 @@ namespace net {
 
 const int64_t kMaxHSTSAgeSecs = 86400 * 365;  // 1 year
 
+// RFC7469 suggests that 60 days is a reasonable maximum max-age value
+// http://tools.ietf.org/html/rfc7469#section-4.1
+const int64_t kMaxHPKPAgeSecs = 86400 * 60;  // 60 days
+
 // Parses |value| as a Strict-Transport-Security header value. If successful,
 // returns true and sets |*max_age| and |*include_subdomains|.
 // Otherwise returns false and leaves the output parameters unchanged.