1---
2c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
3SPDX-License-Identifier: curl
4Title: CURLOPT_UNRESTRICTED_AUTH
5Section: 3
6Source: libcurl
7See-also:
8  - CURLINFO_REDIRECT_COUNT (3)
9  - CURLOPT_FOLLOWLOCATION (3)
10  - CURLOPT_MAXREDIRS (3)
11  - CURLOPT_REDIR_PROTOCOLS_STR (3)
12  - CURLOPT_USERPWD (3)
13Protocol:
14  - HTTP
15Added-in: 7.10.4
16---
17
18# NAME
19
20CURLOPT_UNRESTRICTED_AUTH - send credentials to other hosts too
21
22# SYNOPSIS
23
24~~~c
25#include <curl/curl.h>
26
27CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UNRESTRICTED_AUTH,
28                          long goahead);
29~~~
30
31# DESCRIPTION
32
33Set the long *gohead* parameter to 1L to make libcurl continue to send
34authentication (user+password) credentials or explicitly set cookie headers
35when following locations, even when the host changes. This option is
36meaningful only when setting CURLOPT_FOLLOWLOCATION(3).
37
38Further, when this option is not used or set to **0L**, libcurl does not send
39custom nor internally generated `Authentication:` or `Cookie:` headers on
40requests done to other hosts than the one used for the initial URL. Another
41host means that one or more of hostname, protocol scheme or port number
42changed.
43
44By default, libcurl only sends `Authentication:` or explicitly set `Cookie:`
45headers to the initial host as given in the original URL, to avoid leaking
46username + password to other sites.
47
48This option should be used with caution: when curl follows redirects it
49blindly fetches the next URL as instructed by the server. Setting
50CURLOPT_UNRESTRICTED_AUTH(3) to 1L makes curl trust the server and sends
51possibly sensitive credentials to any host the server points to, possibly
52again and again as the following hosts can keep redirecting to new hosts.
53
54Due to the way HTTP works, almost any header can be made to contain data a
55client may not want to pass on to other servers than the initially intended
56host and for all other headers than the two mentioned above, there is no
57protection from this happening when libcurl is told to follow redirects.
58
59# DEFAULT
60
610
62
63# %PROTOCOLS%
64
65# EXAMPLE
66
67~~~c
68int main(void)
69{
70  CURL *curl = curl_easy_init();
71  if(curl) {
72    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
73    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
74    curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
75    curl_easy_perform(curl);
76  }
77}
78~~~
79
80# %AVAILABILITY%
81
82# RETURN VALUE
83
84Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not.
85