CURLOPT_HEADEROPT: default to separate

Make the HTTP headers separated by default for improved security and
reduced risk for information leakage.

Bug: http://curl.haxx.se/docs/adv_20150429.html
Reported-by: Yehezkel Horowitz, Oren Souroujon

1 files changed, 1 insertions, 0 deletions

diff --git a/lib/url.c b/lib/url.c
index dfd2ff4c5..717ee93fc 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -617,6 +617,7 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
   set->ssl_enable_alpn = TRUE;
 
   set->expect_100_timeout = 1000L; /* Wait for a second by default. */
+  set->sep_headers = TRUE; /* separated header lists by default */
   return result;
 }