patlux · Aug 17, 2026 · Aug 17, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.changes/http-spki-pinning.md b/.changes/http-spki-pinning.md
@@ -0,0 +1,6 @@
+---
+"http": minor
+"http-js": minor
+---
+
+Add an optional native Rustls SPKI pinning transport extension with exact-host pin sets, backup pins for key rotation, normal WebPKI validation, and fail-closed redirect coverage.
diff --git a/.changes/http-transport-extensions.md b/.changes/http-transport-extensions.md
@@ -0,0 +1,6 @@
+---
+"http": minor
+"http-js": minor
+---
+
+Add native transport extension hooks for request validation, final `reqwest::ClientBuilder` configuration, setup, and structured transport error mapping.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/examples/api/src-tauri/Cargo.toml b/examples/api/src-tauri/Cargo.toml
@@ -18,6 +18,10 @@ tauri-build = { workspace = true, features = ["codegen", "isolation"] }
 serde_json = { workspace = true }
 serde = { workspace = true }
 tiny_http = "0.12"
+base64 = "0.22"
+rcgen = "0.13"
+sha2 = "0.10"
+webpki-roots = "1"
 time = "0.3"
 log = { workspace = true }
 tauri-plugin-log = { path = "../../../plugins/log", version = "2.10.1" }
@@ -29,6 +33,7 @@ tauri-plugin-dialog = { path = "../../../plugins/dialog", version = "2.8.2" }
 tauri-plugin-http = { path = "../../../plugins/http", features = [
   "multipart",
   "cookies",
+  "spki-pinning",
 ], version = "2.8.2" }
 tauri-plugin-notification = { path = "../../../plugins/notification", version = "2.6.0" }
 tauri-plugin-os = { path = "../../../plugins/os", version = "2.4.0" }

diff --git a/examples/api/src-tauri/capabilities/base.json b/examples/api/src-tauri/capabilities/base.json
@@ -14,6 +14,12 @@
         },
         {
           "url": "http://127.0.0.1:3004"
+        },
+        {
+          "url": "https://localhost:3005"
+        },
+        {
+          "url": "https://localhost:3006"
         }
       ]
     },

diff --git a/examples/api/src-tauri/src/lib.rs b/examples/api/src-tauri/src/lib.rs
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: MIT
 
 mod cmd;
+mod spki;
 #[cfg(desktop)]
 mod tray;
 
@@ -48,7 +49,11 @@ pub fn run() {
         .plugin(tauri_plugin_biometric::init())
         .plugin(tauri_plugin_clipboard_manager::init())
         .plugin(tauri_plugin_dialog::init())
-        .plugin(tauri_plugin_http::init())
+        .plugin(
+            tauri_plugin_http::Builder::new()
+                .extension(spki::pinning())
+                .build(),
+        )
         .plugin(tauri_plugin_notification::init())
         .plugin(tauri_plugin_os::init())
         .plugin(tauri_plugin_process::init())
-Original file line number
+Diff line change
@@ Expand Up / @@ -14,6 +14,12 @@ @@
             },
             {
               "url": "http://127.0.0.1:3004"
+            },
+            {
+              "url": "https://localhost:3005"
+            },
+            {
+              "url": "https://localhost:3006"
             }
           ]
         },
@@ Expand Down @@