curl / Docs / Protocols / HSTS

HSTS support

HTTP Strict-Transport-Security. Added as experimental in curl 7.74.0. Supported "for real" since 7.77.0.

Standard

HTTP Strict Transport Security

Behavior

libcurl features an in-memory cache for HSTS hosts, so that subsequent HTTP-only requests to a host name present in the cache will get internally "redirected" to the HTTPS version.

curl_easy_setopt() options:

curl cmdline options

HSTS cache file format

Lines starting with # are ignored.

For each hsts entry:

[host name] "YYYYMMDD HH:MM:SS"

The [host name] is dot-prefixed if it is a includeSubDomain.

The time stamp is when the entry expires.

I considered using wget's file format for the HSTS cache. However, they store the time stamp as the epoch (number of seconds since 1970) and I strongly disagree with using that format. Instead I opted to use a format similar to the curl alt-svc cache file format.

Possible future additions