http: on 303, switch to GET

... unless it is a POST and the user explicitly asked to keep doing
POST.

Add test1983/1984: verify --follow with 303 and PUT + custom GET

Fixes #20715
Reported-by: Dan Arnfield
Closes #21280
This commit is contained in:
Daniel Stenberg 2026-04-09 23:43:55 +02:00
parent bb3670f929
commit e5087ac9fc
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 169 additions and 24 deletions

View file

@ -94,8 +94,9 @@ change PUT etc - and therefore also not when libcurl issues a custom PUT. A
(except for HEAD).
To control for which of the 301/302/303 status codes libcurl should *not*
switch back to GET for when doing a custom POST, and instead keep the custom
method, use CURLOPT_POSTREDIR(3).
switch back to GET for when doing a custom POST (a POST transfer using a
modified method), and instead keep the custom method, use
CURLOPT_POSTREDIR(3).
If you prefer a custom POST method to be reset to exactly the method `POST`,
use CURLFOLLOW_FIRSTONLY instead.

View file

@ -32,19 +32,22 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_POSTREDIR,
Pass a bitmask to control how libcurl acts on redirects after POSTs that get a
301, 302 or 303 response back. A parameter with bit 0 set (value
**CURL_REDIR_POST_301**) tells the library to respect RFC 7231 (section
6.4.2 to 6.4.4) and not convert POST requests into GET requests when following
a 301 redirection. Setting bit 1 (value **CURL_REDIR_POST_302**) makes
libcurl maintain the request method after a 302 redirect whilst setting bit 2
(value **CURL_REDIR_POST_303**) makes libcurl maintain the request method
after a 303 redirect. The value **CURL_REDIR_POST_ALL** is a convenience
define that sets all three bits.
**CURL_REDIR_POST_301**) tells the library to not convert POST requests into
GET requests when following a 301 redirection. Setting bit 1 (value
**CURL_REDIR_POST_302**) makes libcurl maintain the request method after a 302
redirect whilst setting bit 2 (value **CURL_REDIR_POST_303**) makes libcurl
maintain the request method after a 303 redirect. The value
**CURL_REDIR_POST_ALL** is a convenience define that sets all three bits.
The non-RFC behavior is ubiquitous in web browsers, so the library does the
conversion by default to maintain consistency. A server may require a POST to
remain a POST after such a redirection. This option is meaningful only when
setting CURLOPT_FOLLOWLOCATION(3).
This option affects transfers where libcurl has been told to use HTTP POST
using for example CURLOPT_POST(3) or CURLOPT_MIMEPOST(3) and not if the
method has merely been modified with CURLOPT_CUSTOMREQUEST(3).
# DEFAULT
0