1--- 2c: Copyright (C) Daniel Stenberg, <daniel.se>, et al. 3SPDX-License-Identifier: curl 4Title: CURLOPT_UNRESTRICTED_AUTH 5Section: 3 6Source: libcurl 7See-also: 8 - CURLINFO_REDIRECT_COUNT (3) 9 - CURLOPT_FOLLOWLOCATION (3) 10 - CURLOPT_MAXREDIRS (3) 11 - CURLOPT_REDIR_PROTOCOLS_STR (3) 12 - CURLOPT_USERPWD (3) 13--- 14 15# NAME 16 17CURLOPT_UNRESTRICTED_AUTH - send credentials to other hosts too 18 19# SYNOPSIS 20 21~~~c 22#include <curl/curl.h> 23 24CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UNRESTRICTED_AUTH, 25 long goahead); 26~~~ 27 28# DESCRIPTION 29 30Set the long *gohead* parameter to 1L to make libcurl continue to send 31authentication (user+password) credentials when following locations, even when 32hostname changed. This option is meaningful only when setting 33CURLOPT_FOLLOWLOCATION(3). 34 35Further, when this option is not used or set to **0L**, libcurl does not 36send custom nor internally generated Authentication: headers on requests done 37to other hosts than the one used for the initial URL. 38 39By default, libcurl only sends credentials and Authentication headers to the 40initial hostname as given in the original URL, to avoid leaking username + 41password to other sites. 42 43This option should be used with caution: when curl follows redirects it 44blindly fetches the next URL as instructed by the server. Setting 45CURLOPT_UNRESTRICTED_AUTH(3) to 1L makes curl trust the server and sends 46possibly sensitive credentials to any host the server points to, possibly 47again and again as the following hosts can keep redirecting to new hosts. 48 49# DEFAULT 50 510 52 53# PROTOCOLS 54 55HTTP 56 57# EXAMPLE 58 59~~~c 60int main(void) 61{ 62 CURL *curl = curl_easy_init(); 63 if(curl) { 64 curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); 65 curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); 66 curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L); 67 curl_easy_perform(curl); 68 } 69} 70~~~ 71 72# AVAILABILITY 73 74Along with HTTP 75 76# RETURN VALUE 77 78Returns CURLE_OK if HTTP is supported, and CURLE_UNKNOWN_OPTION if not. 79