web/src/main/java/org/springframework/security/web/header/writers/HpkpHeaderWriter.java
public void addSha256Pins(String ... pins) {
		for (String pin : pins) {
			Assert.notNull(pin, "pin cannot be null");
			this.pins.put(pin, "sha256");
		}
		updateHpkpHeaderValue();
	}
public void addSha256Pins(String ... pins) {
		for (String pin : pins) {
			Assert.notNull(pin, "pin cannot be null");
			this.pins.put(pin, "sha256");
		}
		updateHpkpHeaderValue();
	}
<p>
Adds a list of SHA256 hashed pins for the pin- directive of the Public-Key-Pins header.
</p>

<p>
The pin directive specifies a way for web host operators to indicate
a cryptographic identity that should be bound to a given web host.
See <a href="https://tools.ietf.org/html/rfc7469#section-2.1.1">Section 2.1.1</a> for additional details.
</p>

<p>
To get a pin of

Public-Key-Pins-Report-Only:
pin-sha256="d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=";
pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="

Use

HpkpHeaderWriter hpkpHeaderWriter = new HpkpHeaderWriter();
hpkpHeaderWriter.addSha256Pins("d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM", "E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g=");
</p>

@param pins a list of base64-encoded SPKI fingerprints.
@throws IllegalArgumentException if a pin is null