CURLOPT_REDIR_PROTOCOLS_STR(3)

💅 NAME 💅

CURLOPT_REDIR_PROTOCOLS_STR — which protocols are allowed to get you redirected to, bestie 🎀

---

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REDIR_PROTOCOLS_STR,
                          char *spec);

---

🦋 DESCRIPTION 🦋

So like, you pass in a pointer to a string, right? And that string is a comma-separated list of protocol names (URL schemes), and it's case insensitive — no worries about capitalization, she doesn't care 💅.

That list is literally the limit on what protocols libcurl is allowed to use in a transfer that it follows to in a redirect, but only when CURLOPT_FOLLOWLOCATION(3) is enabled. So this option is how an application keeps specific transfers on a leash and only lets them use a subset of protocols in redirections. Main character energy for your security posture, honestly 👑

Okay but real talk: protocols that got denied by CURLOPT_PROTOCOLS_STR(3) are not overridden by this option. They stay denied. No cap.

By default libcurl allows HTTP, HTTPS, FTP and FTPS on redirects (since 7.65.2).

These are the available protocols, in all their glory:

DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP,
LDAPS, MQTT, POP3, POP3S, RTMP, RTMPE, RTMPS, RTMPT, RTMPTE, RTMPTS,
RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS, WSS

You can also set "ALL" as a short-cut to enable all protocols. Cute, right? 🫶 But heads up — by setting all, you may enable protocols that weren't even supported the day you wrote this, but get introduced in a future libcurl version. Future-proofing or chaos? You decide 😭

If you try to set a non-existing protocol, or if no matching protocol at all is set, it returns an error. It's giving strict.

Using this option multiple times makes the last set string override the previous ones — last one wins, periodt. Set it to NULL to restore to the internal default 💖

Bestie bonus: the application does not have to keep the string around after setting this option. Set it and dip, you're free 🌸

---

🌈 DEFAULT 🌈

HTTP, HTTPS, FTP and FTPS (Added in 7.65.2).

Older versions defaulted to all protocols except FILE, SCP and since 7.40.0 SMB and SMBS. History lesson, slay 📚

---

🧚 PROTOCOLS 🧚

This functionality affects http only ✨

---

🔥 EXAMPLE 🔥

int main(int argc, char **argv)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    /* pass in the URL from an external source */
    curl_easy_setopt(curl, CURLOPT_URL, argv[1]);

    /* only allow redirects to HTTP and HTTPS URLs */
    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "http,https");

    /* Perform the request */
    curl_easy_perform(curl);
  }
}

See how she only allows redirects to HTTP and HTTPS? Locked down, iconic 👑

---

⭐ AVAILABILITY ⭐

Added in curl 7.85.0

---

💀 RETURN VALUE 💀

Returns CURLE_UNKNOWN_OPTION if the option is not implemented, CURLE_UNSUPPORTED_PROTOCOL if a listed protocol is not supported or disabled, CURLE_BAD_FUNCTION_ARGUMENT if no protocol is listed, else CURLE_OK. Vibe check passed ✅

---

🎀 SEE ALSO 🎀

• CURLINFO_SCHEME(3)
• CURLOPT_DEFAULT_PROTOCOL(3)
• CURLOPT_PROTOCOLS(3)
• CURLOPT_PROTOCOLS_STR(3)
• CURLOPT_REDIR_PROTOCOLS(3)

---

And that's the whole page, bestie! This lil masterpiece comes from the libcurl manual, dated 2026-10-12, and the page itself is CURLOPT_REDIR_PROTOCOLS_STR(3). Go forth and redirect responsibly 💖✨🦋