Re: HSTS cache cap allows eviction of security entries

On Wed, Apr 01, 2026 at 10:55:07PM +0200, Daniel Stenberg via curl-library wrote:
> Today I implemented a cap in how many HSTS entries libcurl keeps in memory, to prevent it from
> being a never-ending growth that could eventually cause problems. I set the limit to 1000 entries,
> quite arbitrarily.

This strikes me as a very low limit, especially since HSTS is intended as a
security measure and having a limit at all is only there for DoS protection.
Given that an HSTS entry doesn't take much space (maybe 100 bytes each per
host), a limit of 1000 is only going to take 0.0001 GB of space. IMHO bumping
it another 2 or 3 orders of magnitude is more appropriate if this is going to
be a hard limit. Three orders of magnitude is only a million hosts which a
crawler with a gigabit Internet connection could reach in a mere 30 seconds,
after which it would start expunging entries, making HSTS useless for it.

Dan
-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library
Etiquette:   https://curl.se/mail/etiquette.html