From 9b29495863c967e2768ea1c517f3ad28a50a9a1b Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 19 Aug 2026 09:32:16 +0200
Subject: [PATCH] http: custom Authorization: header overrides Negotiate

As documented and as it does for other methods.

Difficult to test since it needs a successful kerberos ticket.

Reported-by: sdgh179 on github
Fixes #22610
Closes #22622
---
 lib/http.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/lib/http.c b/lib/http.c
index 511229cd7a..5701bdc09b 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -687,10 +687,19 @@ static CURLcode output_auth_headers(struct Curl_easy *data,
 #endif
 #ifdef USE_SPNEGO
   if(authstatus->picked == CURLAUTH_NEGOTIATE) {
-    auth = "Negotiate";
-    result = Curl_output_negotiate(data, conn, proxy);
-    if(result)
-      return result;
+    if(
+#ifndef CURL_DISABLE_PROXY
+      (proxy && !Curl_checkProxyheaders(data, conn,
+                                        STRCONST("Proxy-authorization"))) ||
+#endif
+      (!proxy && !Curl_checkheaders(data, STRCONST("Authorization")))) {
+      auth = "Negotiate";
+      result = Curl_output_negotiate(data, conn, proxy);
+      if(result)
+        return result;
+    }
+    else
+      authstatus->done = TRUE;
   }
   else
 #endif