CURLOPT_UNRESTRICTED_AUTH(3)

🎀 NAME 🎀

okay so this is a page from the Library Functions Manual, and it's all about CURLOPT_UNRESTRICTED_AUTH — literally the option that lets you send credentials to other hosts too. yes, on purpose. we'll get to the caution part 💀

---

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_UNRESTRICTED_AUTH,
                          long goahead);

---

💖 DESCRIPTION 💖

bestie, here's the tea ☕ — set that long gohead parameter to 1L and libcurl will continue to send authentication (user+password) credentials or explicitly set cookie headers when following locations, even when the host changes. yeah. even then. 🫶

real talk though: this option is meaningful only when you're setting CURLOPT_FOLLOWLOCATION(3). otherwise it's just vibing with nothing to do.

and when this option isn't used, or it's set to 0L? libcurl does not send custom nor internally generated Authentication: or Cookie: headers on requests done to other hosts than the one used for the initial URL. and by "another host" we mean one or more of hostname, protocol scheme or port number changed. so like, any of those switching up counts as a different host, periodt.

by default, libcurl only sends Authentication: or explicitly set Cookie: headers to the initial host as given in the original URL — and that's specifically to avoid leaking username + password to other sites. protect the credentials at all costs, honestly 😭

⚠️ this option should be used with caution. when curl follows redirects it blindly fetches the next URL as instructed by the server. setting CURLOPT_UNRESTRICTED_AUTH(3) to 1L makes curl trust the server and send possibly sensitive credentials to any host the server points to — possibly again and again, since the following hosts can keep redirecting to new hosts. it's giving infinite red flag chain 🔥

and ngl, due to the way HTTP works, almost any header can be made to contain data a client may not want to pass on to other servers than the initially intended host. and for all other headers than the two mentioned above, there is no protection from this happening when libcurl is told to follow redirects. so like. be so serious about this one 🙈

---

🦋 DEFAULT 🦋

0

(stay safe by default, we love to see it ✨)

---

🌸 PROTOCOLS 🌸

this functionality affects http only — that's the whole vibe check, iykyk

---

💜 EXAMPLE 💜

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
    curl_easy_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
    curl_easy_perform(curl);
  }
}

look at that. iconic. ✨

---

🧚 AVAILABILITY 🧚

Added in curl 7.10.4 — she's been around a minute 👑

---

🍓 RETURN VALUE 🍓

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK — slay 💅 — and non-zero means an error occurred. check libcurl-errors(3) for the full deets.

---

🌈 SEE ALSO 🌈

• CURLINFO_REDIRECT_COUNT(3)
• CURLOPT_FOLLOWLOCATION(3)
• CURLOPT_MAXREDIRS(3)
• CURLOPT_REDIR_PROTOCOLS_STR(3)
• CURLOPT_USERPWD(3)

---

okay that's the whole page, no cap 💖 this cutie came to you from libcurl, dated 2026-10-12, and her name is CURLOPT_UNRESTRICTED_AUTH(3) — go be careful with those credentials bestie, mwah 🫶🎀