curl-library
RE: [SECURITY ADVISORY 1/4] libcurl wrong re-use of connections
From: Daniel Stenberg <daniel_at_haxx.se>
Date: Wed, 14 May 2014 09:18:58 +0200 (CEST)
Date: Wed, 14 May 2014 09:18:58 +0200 (CEST)
On Tue, 13 May 2014, Steve Holme wrote:
> Looking back over my patch and how HTTPS used to have the CURLPROTO_HTTP
> flag (and is now a member of PROTO_FAMILY_HTTP) I think I have incorrectly
> added the PROTOPT_CREDSPERREQUEST to HTTPS. I believe taking it off would
> make the code compatible with how it was before my patch.
That doesn't sound correct.
PROTOPT_CREDSPERREQUEST means that the protocol sends full credentials per
request (so that the same connection can be re-used even if the user/password
changes between requests), and HTTP works the same way as HTTPS in that regard
so I really think both should have that bit set.
-- / daniel.haxx.se ------------------------------------------------------------------- List admin: http://cool.haxx.se/list/listinfo/curl-library Etiquette: http://curl.haxx.se/mail/etiquette.htmlReceived on 2014-05-14