CURLOPT_HSTS(3)

okay bestie, this is CURLOPT_HSTS(3) from the Library Functions Manual — we’re talking HSTS cache filename energy, and ngl it’s giving very specific filename main character energy 💅✨

🌸 NAME 🌸

CURLOPT_HSTS - HSTS cache filename 🎀

🦋 SYNOPSIS 🦋

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTS, char *filename);

💖 DESCRIPTION 💖

Okay so the filename? Make the filename point to a filename where libcurl loads an existing HSTS cache from, and where it stores the cache when the easy handle is closed 🫶

Setting a file name with this option also enables HSTS for this handle — that’s the equivalent of setting CURLHSTS_ENABLE with CURLOPT_HSTS_CTRL(3) 👑

If the given file does not exist or contains no HSTS entries at startup, the HSTS cache simply starts empty. No drama, it just vibes empty — lowkey iconic 🌈

Setting the filename to NULL allows HSTS without reading from or writing to any file. NULL also makes libcurl clear the list of files to read HSTS data from, if any such were previously set 🧹

If this option is set multiple times, libcurl loads cache entries from each given file but only stores the last used name for later writing. So it loads from every file, but only stores the last used name for later writing — periodt 💅

🍓 FILE FORMAT 🍓

The HSTS cache is saved to and loaded from a text file with one entry per physical line. Each line in the file has the following format:

[host] [stamp]

[host] is the domain name for the entry and the name is dot-prefixed if it is an entry valid for all subdomains to the name as well or only for the exact name. not me needing to read that dot-prefixed rule twice 😭 but yes, that’s the exact rule, fr fr.

[stamp] is the time (in UTC) when the entry expires and it uses the format YYYYMMDD HH:MM:SS ⏰

Lines starting with # are treated as comments and are ignored. There is currently no length or size limit. Slay, no cap 🌟

💜 DEFAULT 💜

NULL, no filename. Simple. Iconic. Obsessed.

🔥 SECURITY CONCERNS 🔥

bestie, this part is highkey serious: libcurl cannot fully protect against attacks where an attacker has write access to the same directory where it is directed to save files. This is particularly sensitive if you save files using elevated privileges. 🚨

libcurl creates the file to store HSTS data in using default file permissions, meaning that on *nix systems you may need to restrict your umask to prevent other users on the same system from accessing the file. Lock it down, iykyk 🔒

🌈 PROTOCOLS 🌈

This functionality affects http only. That’s the whole protocol vibe check 💫

🎀 EXAMPLE 🎀

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_HSTS, "/home/user/.hsts-cache");
    curl_easy_perform(curl);
  }
}

⭐ AVAILABILITY ⭐

Added in curl 7.74.0 🗓️

👑 RETURN VALUE 👑

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK, non-zero means an error occurred, see libcurl-errors(3) 🫡

🦋 SEE ALSO 🦋

• CURLOPT_ALTSVC(3)
• CURLOPT_HSTS_CTRL(3)
• CURLOPT_RESOLVE(3)

mwah 💖 this lil page comes from libcurl, dated 2026-10-12, and it’s CURLOPT_HSTS(3) — bye bestie, go keep that cache cute! 🎀✨