On Thu, 17 Jul 2014, Michael Osipov wrote:

>> Yes it should! But you're expressing this funnily. If if _does_ probe
>> first, it will disclose the exact same information if the server asks for
>> basic auth
>
> Haven't noticed that I brought some fun into it.

"funny" in the meaning of "strange" or "peculiar".

> I am trying to make a point.
>
> Doing $ 'curl --basic -u ... http://host/proctected
> http://host2/unprotected'

> without using next will reveal. Am I wrong?

No, that's exactly how it works. It sends HTTP Basic credentials in both
requests immediately without probing.

>> CURLAUTH_BASIC | CURLAUTH_ONLY
>
> So adding --auth-only and --proxy-auth-only tied to CURLAUTH_ONLY would
> disable preemptive auth and perform of if challenged? E.g.,
>
> $ curl --basic --digest -u ... --auth-only <URL>

Yes - if you truly want only that particular auth method AND a "probe". But I
would argue that the options should be named differently! =)

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html