How to Implement an HSTS Preload List Mock in Python

Implements a mock HSTS preload list in Python that supports adding, removing, checking domains with subdomain inheritance, and listing domains.

Easy Python 3.9+ Aug 9, 2026 Auth & security at scale 15 views 0 copies

hsts security domains mock preload stdlib

Python code

42 lines

Python 3.9+

import json

class HSTSPreloadList:
    def __init__(self):
        self.domains = {}

    def add_domain(self, domain, include_subdomains=False, max_age=31536000):
        self.domains[domain] = {
            "include_subdomains": include_subdomains,
            "max_age": max_age
        }

    def remove_domain(self, domain):
        if domain in self.domains:
            del self.domains[domain]

    def contains(self, domain):
        exact = domain in self.domains
        if exact:
            return True
        parts = domain.split(".")
        for i in range(1, len(parts)):
            parent = ".".join(parts[i:])
            if parent in self.domains and self.domains[parent]["include_subdomains"]:
                return True
        return False

    def list_domains(self):
        return sorted(self.domains.keys())

if __name__ == "__main__":
    preload = HSTSPreloadList()
    preload.add_domain("example.com", include_subdomains=True)
    preload.add_domain("secure.org", max_age=86400)
    
    print("Contains 'www.example.com':", preload.contains("www.example.com"))
    print("Contains 'example.com':", preload.contains("example.com"))
    print("Contains 'sub.secure.org':", preload.contains("sub.secure.org"))
    print("Contains 'unknown.net':", preload.contains("unknown.net"))
    
    preload.remove_domain("secure.org")
    print("Domains after removal:", preload.list_domains())

Output

stdout

Contains 'www.example.com': True
Contains 'example.com': True
Contains 'sub.secure.org': False
Contains 'unknown.net': False
Domains after removal: ['example.com']

How it works

The HSTSPreloadList class stores domains in a dictionary, keyed by the domain name, with attributes for include_subdomains and max_age. The contains method first checks for an exact match, then progressively splits the domain from the left to check if any parent domain with include_subdomains=True exists. This mirrors how browsers handle HSTS preload subdomain coverage. Adding and removing domains are simple dictionary operations, and list_domains returns a sorted list for deterministic output. The code is self-contained and uses only the standard library, making it easy to adapt for security-focused projects.

Common mistakes

Forgetting to handle parent domain checks when include_subdomains is False
Assuming contains() is case-insensitive, but the implementation is case-sensitive
Not updating the dictionary when adding a domain that already exists
Misunderstanding that preload lists usually require both HTTPS and HSTS headers, but this mock only tracks domains

Variations

Use a set for exact matches and a separate list for subdomain wildcards to speed up lookups
Load and save the preload list to a JSON file using json.dump and json.load

Real-world use cases

Simulating a browser's HSTS preload list during security testing or compliance checks.
Building a small internal tool to manage HSTS preload submissions for a company's domains.
Teaching or demonstrating how HSTS preload and subdomain policies work in a training environment.

How to Implement an HSTS Preload List Mock in Python

Python code

Output

How it works

Common mistakes

Variations

Real-world use cases

More from Auth & security at scale

Tutorials

Quizzes

Python code

Output

How it works

Common mistakes

Variations

Real-world use cases

More from Auth & security at scale

Keep learning

Tutorials

Quizzes