Re: HSTS cache cap allows eviction of security entries

On Wed, 1 Apr 2026, Timothe Litt via curl-library wrote:

> Store the HSTS list on disk (persisting it is good);

That's why libcurl offers that in its API. It still needs to be able to 
function with the cache in memory.

> you can use a memory cache of both positive [site -> HSTS records]  and 
> negative [site -> 'has no HSTS']  entries - and limit its size.

A typical user scenario has perhaps a handful of hostnames in the list that 
should be bumped to HTTPS. I don't see how adding negative info to this makes 
the data smaller.

> Or let a database (e.g. SQLite) manage the list.  You don't have to invent 
> your own.

This is over-engineering terrority. SQLite is itself larger than the whole of 
libcurl. HSTS is a rather tiny edge feature. No one wants libcurl to explode 
in size and complexity just to support this.

-- 

  / daniel.haxx.se || https://rock-solid.curl.dev

-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library
Etiquette:   https://curl.se/mail/etiquette.html