From d23fa6e4b6b960298a0a8683b9055e9ee9b9503b Mon Sep 17 00:00:00 2001 From: Joel Depooter Date: Fri, 3 Jul 2026 12:39:13 -0700 Subject: [PATCH] CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization' instead of 'Authentication' Closes #22256 --- docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md b/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md index 2dc15ca6b0..37a9fe5611 100644 --- a/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md +++ b/docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md @@ -36,12 +36,12 @@ when following locations, even when the host changes. This option is meaningful only when setting CURLOPT_FOLLOWLOCATION(3). Further, when this option is not used or set to **0L**, libcurl does not send -custom nor internally generated `Authentication:` or `Cookie:` headers on +custom nor internally generated `Authorization:` or `Cookie:` headers on requests done to other hosts than the one used for the initial URL. Another host means that one or more of hostname, protocol scheme or port number changed. -By default, libcurl only sends `Authentication:` or explicitly set `Cookie:` +By default, libcurl only sends `Authorization:` or explicitly set `Cookie:` headers to the initial host as given in the original URL, to avoid leaking username + password to other sites.