From: Daniel Stenberg Date: Wed, 10 Dec 2025 11:40:47 +0100 Subject: [PATCH] curl_sasl: if redirected, require permission to use bearer Closes #19933 Backported-by: Samuel Henrique * Refresh patch context for lib/curl_sasl.c --- lib/curl_sasl.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c index 4fcbaac..8706491 100644 --- a/lib/curl_sasl.c +++ b/lib/curl_sasl.c @@ -356,7 +356,10 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data, data->set.str[STRING_SERVICE_NAME] : sasl->params->service; #endif - const char *oauth_bearer = data->set.str[STRING_BEARER]; + const char *oauth_bearer = + (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ? + data->set.str[STRING_BEARER] : NULL; + struct bufref nullmsg; Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port); @@ -543,7 +546,10 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data, data->set.str[STRING_SERVICE_NAME] : sasl->params->service; #endif - const char *oauth_bearer = data->set.str[STRING_BEARER]; + const char *oauth_bearer = + (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ? + data->set.str[STRING_BEARER] : NULL; + struct bufref serverdata; Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);