Repository navigation
curl manual: cross-reference --location-trusted from flag documentation related to specifying authentication #16160
Description
Activity
Actually,
-HsaysWARNING: headers set with this option are set in all HTTP requests - even after redirects are followed, like when told with [-L, --location](https://curl.se/docs/manpage.html#-L). This can lead to the header being sent to other hosts than the original host, so sensitive headers should be used with caution combined with following redirects., so it may be a bug after all?It is on purpose, just not documented properly. I'll do a PR for it.
- added a commit that references this issue
on Feb 4, 2025 Sorry, I meant documentation bug. Thanks. :)
- added a commit that references this issue
on Feb 6, 2025 - added a commit that references this issue
on Apr 26, 2025
Specify which documentation you found a problem with
The problem is in the curl manual page up to 8.11.1 assuming https://curl.se/docs/manpage.html is up to date.
This is more a quality-of-life issue than an error.
The problem
It's not entirely obvious on initial inspection why curl isn't forwarding
-H "Authorization: ..."(which where manual implies-His permanent, though presumably curl specifically strips the Authorization header subsequently..) or-u use:passwhen following redirects according to-L. The-Ldocumentation does describe the problem and cross references to--location-trusted, but for me it was more intuitive to look under-Hand-uwhen I initially discovered the "missing" authorization headers in-voutput.-H(which is more generic) and-ugive no mention of stripping (under redirects).