diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2015-03-20 12:03:09 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2015-03-20 12:03:09 +0100 |
| commit | 2b7ac4e710305122c386a8206c3195c65c57e692 (patch) | |
| tree | 9473965a5fe310f29947023ad2b739d8f7ce4a82 /docs | |
| parent | 7868dc7103b40484d177985bb04270250a50e262 (diff) | |
CURLOPT_HTTPHEADER.3: add a "SECURITY CONCERNS" section
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/libcurl/opts/CURLOPT_HTTPHEADER.3 | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 index ad0134031..6a1b86c63 100644 --- a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 +++ b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 @@ -63,11 +63,20 @@ Pass a NULL to this option to reset back to no custom headers. The most commonly replaced headers have "shortcuts" in the options \fICURLOPT_COOKIE(3)\fP, \fICURLOPT_USERAGENT(3)\fP and -\fICURLOPT_REFERER(3)\fP. +\fICURLOPT_REFERER(3)\fP. We recommand using those. There's an alternative option that sets or replaces headers only for requests that are sent with CONNECT to a proxy: \fICURLOPT_PROXYHEADER(3)\fP. Use \fICURLOPT_HEADEROPT(3)\fP to control the behavior. +.SH SECURITY CONCERNS +By default, this option makes libcurl send the given headers in all HTTP +requests done by this handle. You should therefore use this option with +caution if you for example connect to the remote site using a proxy and a +CONNECT request, you should to consider if that proxy is supposed to also get +the headers. They may be private or otherwise sensitive to leak. + +Use \fICURLOPT_HEADEROPT(3)\fP to make the headers only get sent to where you +intend them to get sent. .SH DEFAULT NULL .SH PROTOCOLS |