1--- 2c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. 3SPDX-License-Identifier: curl 4Title: CURLOPT_HTTPHEADER 5Section: 3 6Source: libcurl 7Protocol: 8 - HTTP 9 - SMTP 10 - IMAP 11See-also: 12 - CURLOPT_CUSTOMREQUEST (3) 13 - CURLOPT_HEADER (3) 14 - CURLOPT_HEADEROPT (3) 15 - CURLOPT_MIMEPOST (3) 16 - CURLOPT_PROXYHEADER (3) 17 - curl_mime_init (3) 18--- 19 20# NAME 21 22CURLOPT_HTTPHEADER - set of HTTP headers 23 24# SYNOPSIS 25 26~~~c 27#include <curl/curl.h> 28 29CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPHEADER, 30 struct curl_slist *headers); 31~~~ 32 33# DESCRIPTION 34 35Pass a pointer to a linked list of HTTP headers to pass to the server and/or 36proxy in your HTTP request. The same list can be used for both host and proxy 37requests! 38 39When used within an IMAP or SMTP request to upload a MIME mail, the given 40header list establishes the document-level MIME headers to prepend to the 41uploaded document described by CURLOPT_MIMEPOST(3). This does not affect 42raw mail uploads. 43 44The linked list should be a fully valid list of **struct curl_slist** 45structs properly filled in. Use curl_slist_append(3) to create the list 46and curl_slist_free_all(3) to clean up an entire list. If you add a 47header that is otherwise generated and used by libcurl internally, your added 48header is used instead. If you add a header with no content as in 'Accept:' 49(no data on the right side of the colon), the internally used header is 50disabled/removed. With this option you can add new headers, replace internal 51headers and remove internal headers. To add a header with no content (nothing 52to the right side of the colon), use the form 'name;' (note the ending 53semicolon). 54 55The headers included in the linked list **must not** be CRLF-terminated, 56because libcurl adds CRLF after each header item itself. Failure to comply 57with this might result in strange behavior. libcurl passes on the verbatim 58strings you give it, without any filter or other safe guards. That includes 59white space and control characters. 60 61The first line in an HTTP request (containing the method, usually a GET or 62POST) is not a header and cannot be replaced using this option. Only the lines 63following the request-line are headers. Adding this method line in this list 64of headers only causes your request to send an invalid header. Use 65CURLOPT_CUSTOMREQUEST(3) to change the method. 66 67When this option is passed to curl_easy_setopt(3), libcurl does not copy 68the entire list so you **must** keep it around until you no longer use this 69*handle* for a transfer before you call curl_slist_free_all(3) on 70the list. 71 72Pass a NULL to this option to reset back to no custom headers. 73 74The most commonly replaced HTTP headers have "shortcuts" in the options 75CURLOPT_COOKIE(3), CURLOPT_USERAGENT(3) and 76CURLOPT_REFERER(3). We recommend using those. 77 78There is an alternative option that sets or replaces headers only for requests 79that are sent with CONNECT to a proxy: CURLOPT_PROXYHEADER(3). Use 80CURLOPT_HEADEROPT(3) to control the behavior. 81 82# SPECIFIC HTTP HEADERS 83 84Setting some specific headers causes libcurl to act differently. 85 86## Host: 87 88The specified hostname is used for cookie matching if the cookie engine is 89also enabled for this transfer. If the request is done over HTTP/2 or HTTP/3, 90the custom hostname is instead used in the ":authority" header field and 91Host: is not sent at all over the wire. 92 93## Transfer-Encoding: chunked 94 95Tells libcurl the upload is to be done using this chunked encoding instead of 96providing the Content-Length: field in the request. 97 98# SPECIFIC MIME HEADERS 99 100When used to build a MIME email for IMAP or SMTP, the following document-level 101headers can be set to override libcurl-generated values: 102 103## Mime-Version: 104 105Tells the parser at the receiving site how to interpret the MIME framing. 106It defaults to "1.0" and should normally not be altered. 107 108## Content-Type: 109 110Indicates the document's global structure type. By default, libcurl sets it 111to "multipart/mixed", describing a document made of independent parts. When a 112MIME mail is only composed of alternative representations of the same data 113(i.e.: HTML and plain text), this header must be set to "multipart/alternative". 114In all cases the value must be of the form "multipart/*" to respect the 115document structure and may not include the "boundary=" parameter. 116 117Other specific headers that do not have a libcurl default value but are 118strongly desired by mail delivery and user agents should also be included. 119These are "From:", "To:", "Date:" and "Subject:" among others and their 120presence and value is generally checked by anti-spam utilities. 121 122# SECURITY CONCERNS 123 124By default, this option makes libcurl send the given headers in all HTTP 125requests done by this handle. You should therefore use this option with 126caution if you for example connect to the remote site using a proxy and a 127CONNECT request, you should to consider if that proxy is supposed to also get 128the headers. They may be private or otherwise sensitive to leak. 129 130Use CURLOPT_HEADEROPT(3) to make the headers only get sent to where you 131intend them to get sent. 132 133Custom headers are sent in all requests done by the easy handle, which implies 134that if you tell libcurl to follow redirects 135(CURLOPT_FOLLOWLOCATION(3)), the same set of custom headers is sent in 136the subsequent request. Redirects can of course go to other hosts and thus 137those servers get all the contents of your custom headers too. 138 139Starting in 7.58.0, libcurl specifically prevents "Authorization:" headers 140from being sent to other hosts than the first used one, unless specifically 141permitted with the CURLOPT_UNRESTRICTED_AUTH(3) option. 142 143Starting in 7.64.0, libcurl specifically prevents "Cookie:" headers from being 144sent to other hosts than the first used one, unless specifically permitted 145with the CURLOPT_UNRESTRICTED_AUTH(3) option. 146 147# DEFAULT 148 149NULL 150 151# EXAMPLE 152 153~~~c 154int main(void) 155{ 156 CURL *curl = curl_easy_init(); 157 158 struct curl_slist *list = NULL; 159 160 if(curl) { 161 curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); 162 163 list = curl_slist_append(list, "Shoesize: 10"); 164 list = curl_slist_append(list, "Accept:"); 165 166 curl_easy_setopt(curl, CURLOPT_HTTPHEADER, list); 167 168 curl_easy_perform(curl); 169 170 curl_slist_free_all(list); /* free the list */ 171 } 172} 173~~~ 174 175# AVAILABILITY 176 177As long as HTTP is enabled. Use in MIME mail added in 7.56.0. 178 179# RETURN VALUE 180 181Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not. 182