Refresh, retain and remove one host’s stored policy
03The browser stores each issuing host’s own policy with an expiry time and a subdomain flag. max-age is a duration measured from reception, not a fixed date chosen when the site first deployed HSTS.
At time 250, a valid secure max-age=0 removes example.com’s own record. The old deadline is no longer relevant. Alternatively, without a refresh or deletion, an expired record is evicted when its lifetime is reached.
Source for this drawing: RFC 6797 · Read RFC section 8.1.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A fresh valid header refreshes the deadline; silence is not deletion.
- For the worked example, receipt at time 0 with max-age=300 sets expiry to 300. Receipt of the same max-age at time 100 moves expiry to 400. The new deadline conveys fresh information even though the written duration is unchanged (§11.2).
- A secure response missing the header MUST leave a known host’s policy in effect until its lifetime is reached. A malformed or insecurely received header does not replace that policy either.
- max-age=0 received validly over error-free secure transport MUST remove this issuing host’s policy, including its stored includeSubDomains flag. If the host was unknown, it MUST NOT be newly noted.
- Expired policy records MUST be evicted. Per-host state is independent: a host’s update MUST NOT modify a matching parent domain’s expiry or subdomain flag.
- The browser MUST NOT note an IP address literal as a known HSTS host. A hostname policy is not indexed by a URL path or port, nor does it automatically cover the same server’s IP address.
Times are seconds on a fictional clock, chosen for arithmetic clarity rather than as deployment advice. The local model uses exact integer arithmetic; real browser persistence, clocks and preload management are outside it. Rejected erratum5372 does not prevent the same-duration refresh described in §11.2.
Read the RFC section ↗