Re: [PATCH v2] http: preserve wwwauth_headers across redirects

["Michal Suchánek" <msuchanek@suse.de>]

Hello,

On Wed, Nov 04, 2026 at 01:24:23AM -0500, Jeff King wrote:
> On Wed, Aug 19, 2026 at 08:21:04PM -0700, Aaron Plattner wrote:
> 
> > When cURL follows a redirect, it calls the CURLOPT_HEADERFUNCTION for
> > each header received including ones from a redirect. http_request() sets
> > fwrite_wwwauth() as the header function, which will record the wwwauth[]
> > entries for the last step in the redirection chain.
> > 
> > However, when http_request_recoverable() sees that cURL followed a
> > redirect, it attempts to update the credentials for the request from the
> > new URL using credential_from_url(). The first thing that does is call
> > credential_clear(), which clears everything including wwwauth_headers.
> > 
> > If the new URL should use a credential helper rather than credentials
> > embedded in the URL, this loses the list of authentication methods that
> > the server provided in the redirect.

I think the decscription here is inconsistent.

In the first paragraph it sounds like the wwwauth comes from the
redirected-to URL, while in the last paragraph it sounds like it comes
from the initial URL.

I think it would be good to word this more clearly.

Thanks

Michal