CURLOPT_HSTSREADFUNCTION(3)

💖 CURLOPT_HSTSREADFUNCTION 💖

okay so bestie, this one is from the Library Functions Manual and it's literally all about feeding your HSTS hosts into libcurl with your own lil callback 🎀 no cap.

---

✨ NAME ✨

CURLOPT_HSTSREADFUNCTION — the read callback for HSTS hosts, aka the glow-up your HSTS cache deserves 💅

---

🌸 SYNOPSIS 🌸

#include <curl/curl.h>

struct curl_hstsentry {
  char *name;
  size_t namelen;
  unsigned int includeSubDomains:1;
  char expire[18]; /* YYYYMMDD HH:MM:SS [null-terminated] */
};

CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *sts, void *clientp);

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HSTSREADFUNCTION, hstsread);

---

🦋 DESCRIPTION 🦋

Pass a pointer to your callback function, exactly like the prototype up there shows you 👆

So this callback gets called by libcurl repeatedly when it populates the in-memory HSTS cache. Like, it's not a one-and-done thing — libcurl keeps coming back for more, and honestly? iconic behavior.

Set the clientp argument with the CURLOPT_HSTSREADDATA(3) option — or it's just NULL, no pressure 🫶

When this callback is invoked, the sts pointer points to a populated struct. Here's your checklist, bestie:

• Copy the hostname to name (no longer than namelen bytes). Make it null-terminated ✨
• Set includeSubDomains to TRUE or FALSE
• Set expire to a date stamp, or a zero length string for forever

⚠️ heads up: a wrong date stamp format might cause the name to not get accepted. so like, format it right the first time fr 💀

The callback should return CURLSTS_OK if it returns a name and is prepared to be called again (for another host), or CURLSTS_DONE if it has no entry to return. It can also return CURLSTS_FAIL to signal error. Returning CURLSTS_FAIL stops the transfer from being performed and makes CURLE_ABORTED_BY_CALLBACK get returned. so like, that's the nuclear option, use it with intention 😭

🚨 and listen — this option does not enable HSTS. you need to use CURLOPT_HSTS_CTRL(3) to do that. don't skip that step bestie, otherwise you're just out here doing nothing 💀

---

🎀 DEFAULT 🎀

NULL — no callback. literally nobody home 🙈

---

🌈 PROTOCOLS 🌈

This functionality affects http only. that's it. that's the whole vibe check.

---

⭐ EXAMPLE ⭐

struct priv {
  void *custom;
};

static CURLSTScode hsts_cb(CURL *easy, struct curl_hstsentry *sts,
                           void *clientp)
{
  /* populate the struct as documented */
  return CURLSTS_OK;
}

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    struct priv my_stuff;
    CURLcode result;

    /* set HSTS read callback */
    curl_easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hsts_cb);

    /* pass in suitable argument to the callback */
    curl_easy_setopt(curl, CURLOPT_HSTSREADDATA, &my_stuff);

    result = curl_easy_perform(curl);
  }
}

see how the CURLOPT_HSTSREADDATA gets the &my_stuff? that's the clientp babe, that's how it finds its way back to you 🫶

---

👑 AVAILABILITY 👑

Added in curl 7.74.0 — so if you're on anything older than that, it's giving before-our-time, sorry bestie 😭

---

💜 RETURN VALUE 💜

This returns CURLE_OK. slay. no drama, no surprises, just good vibes ✨

---

🔥 SEE ALSO 🔥

• CURLOPT_HSTS(3)
• CURLOPT_HSTSREADDATA(3)
• CURLOPT_HSTSWRITEFUNCTION(3)
• CURLOPT_HSTS_CTRL(3)

go read those next, iykyk 💅

---

later bestie 🦋 — this gem's from libcurl, dated 2026-10-12, and it ate, no crumbs. mwah 💖