From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 6 Mar 2026 23:13:07 +0100
Subject: [PATCH] http: only send bearer if auth is allowed

Verify with test 2006

Closes #20843

Backported-by: Samuel Henrique <samueloph@debian.org>
 * Refresh patch context for lib/http.c
 * Adapt the new tests/data/test2006: reuse the
   existing test486 as the base (similarity-copy in the diff), keep the
   test definition structurally as upstream wants but also drop the two
   now-stale "#" comment lines that already differ between upstream's and
   our test486.
---
 lib/http.c                       |  5 +++--
 tests/data/Makefile.am           |  2 +-
 tests/data/{test486 => test2006} | 43 +++++++++++++++++-----------------------
 3 files changed, 22 insertions(+), 28 deletions(-)
 copy tests/data/{test486 => test2006} (83%)

diff --git a/lib/http.c b/lib/http.c
index 5942d31..4e15784 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -696,8 +696,9 @@ output_auth_headers(struct Curl_easy *data,
 #ifndef CURL_DISABLE_BEARER_AUTH
   if(authstatus->picked == CURLAUTH_BEARER) {
     /* Bearer */
-    if((!proxy && data->set.str[STRING_BEARER] &&
-        !Curl_checkheaders(data, STRCONST("Authorization")))) {
+    if(!proxy && data->set.str[STRING_BEARER] &&
+        Curl_auth_allowed_to_host(data) &&
+        !Curl_checkheaders(data, STRCONST("Authorization"))) {
       auth = "Bearer";
       result = http_output_bearer(data);
       if(result)
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index ab21e0e..934ba80 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -242,7 +242,7 @@ test1955 test1956 test1957 test1958 test1959 test1960 test1964 \
 test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
 test1978 test1979 test1980 \
 \
-test2000 test2001 test2002 test2003 test2004 test2005 \
+test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
 \
                                                                test2023 \
 test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
diff --git a/tests/data/test486 b/tests/data/test2006
similarity index 83%
copy from tests/data/test486
copy to tests/data/test2006
index 53efae5..4b8b269 100644
--- a/tests/data/test486
+++ b/tests/data/test2006
@@ -1,3 +1,4 @@
+<?xml version="1.0" encoding="US-ASCII"?>
 <testcase>
 <info>
 <keywords>
@@ -5,7 +6,6 @@ netrc
 HTTP
 </keywords>
 </info>
-#
 # Server-side
 <reply>
 <data crlf="yes">
@@ -59,7 +59,6 @@ target
 </datacheck>
 </reply>
 
-#
 # Client-side
 <client>
 <server>
@@ -69,37 +68,31 @@ http
 proxy
 </features>
 <name>
-.netrc with redirect and "default" with no password or login
+.netrc default with redirect plus oauth2-bearer
 </name>
 <command>
---netrc --netrc-file %LOGDIR/netrc%TESTNUMBER -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
 </command>
 <file name="%LOGDIR/netrc%TESTNUMBER" >
-
-machine a.com
-  login alice
-  password alicespassword
-
-default
-
+default login testuser password testpass
 </file>
 </client>
 
 <verify>
-<protocol>
-GET http://a.com/ HTTP/1.1
-Host: a.com
-Authorization: Basic %b64[alice:alicespassword]b64%
-User-Agent: curl/%VERSION
-Accept: */*
-Proxy-Connection: Keep-Alive
-
-GET http://b.com/%TESTNUMBER0002 HTTP/1.1
-Host: b.com
-User-Agent: curl/%VERSION
-Accept: */*
-Proxy-Connection: Keep-Alive
-
+<protocol crlf="yes">
+GET http://a.com/ HTTP/1.1
+Host: a.com
+Authorization: Bearer SECRET_TOKEN
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
+Host: b.com
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
 </protocol>
 </verify>
 </testcase>