cURL / Mailing Lists / curl-library / Single Mail


RE: [SECURITY ADVISORY 1/4] libcurl wrong re-use of connections

From: Daniel Stenberg <>
Date: Wed, 14 May 2014 09:18:58 +0200 (CEST)

On Tue, 13 May 2014, Steve Holme wrote:

> Looking back over my patch and how HTTPS used to have the CURLPROTO_HTTP
> flag (and is now a member of PROTO_FAMILY_HTTP) I think I have incorrectly
> added the PROTOPT_CREDSPERREQUEST to HTTPS. I believe taking it off would
> make the code compatible with how it was before my patch.

That doesn't sound correct.

PROTOPT_CREDSPERREQUEST means that the protocol sends full credentials per
request (so that the same connection can be re-used even if the user/password
changes between requests), and HTTP works the same way as HTTPS in that regard
so I really think both should have that bit set.

List admin:
Received on 2014-05-14