Only password is forwarded when redirecting?

[tobiasBora]

I did this

There are a number of really weird things with http auth:

$ export USER=dummyUser
$ export PASSWD=dummyPasswd
$ curl --location-trusted "https://${USER}:${PASSWD}@edt.grenoble-inp.fr/directCal/2024-2025/enseignant?resources=0" -v

sends:

> Authorization: Basic ZHVtbXlVc2VyOmR1bW15UGFzc3dk (<== base 64 of the dummyUser:dummyPasswd: fine)

for the first message (before the redirection), but after the redirection, it sends:

> Authorization: Basic OmR1bW15UGFzc3dk (<== base 64 of :dummyPasswd: without the user!)

i.e. the user is removed from the authorization! (and of course auth fails even for valid user). On the other hand, manually setting the header works, and also using:

$ curl --location-trusted "https://edt.grenoble-inp.fr/directCal/2024-2025/enseignant?resources=0" -v -u "${USER}:${PASSWD}"

works (of course with dummy passwords you will not login successfully, but the log show that the user appear also in the second message). This is quite weird IMHO, as I would expect the -u option to be equivalent to user:passwd@website.

I expected the following

The user should also be forwarded together with the password not just when using -u but also when using the user:passwd@host notation.

curl/libcurl version

Tried with both 8.6.0 and 8.9.1

curl 8.6.0 (x86_64-pc-linux-gnu) libcurl/8.6.0 OpenSSL/3.0.13 zlib/1.3.1 brotli/1.1.0 zstd/1.5.5 libidn2/2.3.7 libpsl/0.21.5 libssh2/1.11.0 nghttp2/1.59.0
Release-Date: 2024-01-31
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

curl 8.9.1 (x86_64-pc-linux-gnu) libcurl/8.9.1 OpenSSL/3.0.14 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libpsl/0.21.5 libssh2/1.11.0 nghttp2/1.62.1
Release-Date: 2024-07-31
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

operating system

NixOs unstable