cURL / Mailing Lists / curl-library / Single Mail


Re: Bug report: cookies and redirection

From: Daniel Stenberg <>
Date: Fri, 11 Apr 2008 10:11:21 +0200 (CEST)

On Thu, 10 Apr 2008, Ben Combee wrote:

>> If you'd rather want a cookie added to the "engine" and thus sent only to
>> the proper host etc you probably should rather add the cookie with
> I'm querying another source for cookies based on the URLs I'm fetching, so I
> don't have a full list available for setting before my query.

Despite its name, you can add single cookies with that.

> If I call curl_easy_setop(CURLOPT_COOKIE) with my new cookie while
> processing the Location header, will that new cookie value be used for the
> redirected connection?

Yes I think so, although I'm not sure it is something I want to document and
encourage. Similar things have backfired in the past.

> However, when I looked in the code, it looked like the Location: header
> parsing was a more complicated than grabbing the value after Location and
> chopping off leading/trailing whitespace because of hacks to deal with
> non-absolute URLs there.

Yes, following a HTTP redirection involves more magic than one might first
think of. Mostly because of relative URLs but also because of (other) spec
violations that the popular browsers support and survive.

> I didn't see any way to access that redirected URL value stored in
> req.newurl until after the new transfer has started when you can query it
> via CURLINFO_EFFECTIVE_URL, and at that time, it's too late to add or change
> cookies.

Ah right, if you don't know the host before the redirection is made you can't
really know for what host or path to add the cookie for...

To me it just seems a bit unusual that you want to add a cookie to a request
to a host/path you have no clue about previously. But I see how the current
API is not covering for this unless you do the redirection following yourself.

> What I'd love to see would be a curl_easy_getinfo option that let me query
> the req.newurl value, something like CURLINFO_REDIRECTED_URL, and for that
> to be set even if I have "alwaysfollow" turned off, so I could manually do
> the re-request using the right value when I get a 3xx series result code.

Hey, that's a really good idea methinks. That way people (like you) who need
more magic to happen between requests can still do that without
(re-)implementing the redirection logic that libcurl already features.

Would you be able to work on a patch for introducing this?

  Commercial curl and libcurl Technical Support:
Received on 2008-04-11