On Tue, 24 Apr 2012, Pingzhong Li wrote:

> We are using CURLOPT_HTTPHEADER to set some HTTP header for https
> communications. I found out that those headers are actually used for proxy
> connection as well. I looked at the code and confirmed it
> (Curl_add_custom_headers function is shared by both proxy and http). Since
> connection to proxy is http and those headers won't be encrypted, what if
> user want to pass some secret information on the https headers?

That's indeed a limitation in the current API.

> Is there any way not to append the custom http headers in the proxy
> connection since proxy connection should not need those custom headers (at
> least in our case)? Or is there a separate option to specify the custom http
> header only for proxy connection? From my current reading, I didn't find a
> way, I just want to confirm my findings here.

I think we need a new option for this. Or possibly two, one for each specific
request...

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html