From e3d7401a32a46516c9e5ee877e613e62ed35bddc Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 6 Mar 2026 23:13:07 +0100
Subject: [PATCH] http: only send bearer if auth is allowed

Verify with test 2006

Closes #20843

Curl_auth_allowed_to_host() function got renamed from
Curl_allow_auth_to_host() by the commit
https://github.com/curl/curl/commit/72652c0613d37ce18e99cca17a42887f12ad43da

Current curl version 7.82.0 has function Curl_allow_auth_to_host()

Upstream-Status: Backport [https://github.com/curl/curl/commit/e3d7401a32a46516c9e5ee877]
CVE: CVE-2026-3783
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 lib/http.c              |  1 +
 tests/data/Makefile.inc |  2 +-
 tests/data/test2006     | 98 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 100 insertions(+), 1 deletion(-)
 create mode 100644 tests/data/test2006

diff --git a/lib/http.c b/lib/http.c
index 691091b..6acd537 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -757,6 +757,7 @@ output_auth_headers(struct Curl_easy *data,
   if(authstatus->picked == CURLAUTH_BEARER) {
     /* Bearer */
     if((!proxy && data->set.str[STRING_BEARER] &&
+	Curl_allow_auth_to_host(data) &&
         !Curl_checkheaders(data, STRCONST("Authorization")))) {
       auth = "Bearer";
       result = http_output_bearer(data);
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
index ad41a5e..e641cb8 100644
--- a/tests/data/Makefile.inc
+++ b/tests/data/Makefile.inc
@@ -221,7 +221,7 @@ test1916 test1917 test1918 \
 \
 test1933 test1934 test1935 test1936 test1937 test1938 test1939 \
 \
-test2000 test2001 test2002 test2003 test2004 \
+test2000 test2001 test2002 test2003 test2004 test2006 \
 \
                                                                test2023 \
 test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
diff --git a/tests/data/test2006 b/tests/data/test2006
new file mode 100644
index 0000000..200d30a
--- /dev/null
+++ b/tests/data/test2006
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+HTTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+-foo-
+</data>
+
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</data2>
+
+<datacheck crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc default with redirect plus oauth2-bearer
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+default login testuser password testpass
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://a.com/ HTTP/1.1
+Host: a.com
+Authorization: Bearer SECRET_TOKEN
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
+Host: b.com
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
-- 
2.25.1