From 1a822275d333dc6da6043497160fd04c8fa48640 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 10 Dec 2025 11:40:47 +0100 Subject: [PATCH] curl_sasl: if redirected, require permission to use bearer Closes #19933 --- lib/curl_sasl.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c index 3e4bafc19ae4..b93bafbefac3 100644 --- a/lib/curl_sasl.c +++ b/lib/curl_sasl.c @@ -452,7 +452,9 @@ static bool sasl_choose_ntlm(struct Curl_easy *data, struct sasl_ctx *sctx) static bool sasl_choose_oauth(struct Curl_easy *data, struct sasl_ctx *sctx) { - const char *oauth_bearer = data->set.str[STRING_BEARER]; + const char *oauth_bearer = + (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ? + data->set.str[STRING_BEARER] : NULL; if(sctx->user && oauth_bearer && (sctx->enabledmechs & SASL_MECH_OAUTHBEARER)) { @@ -477,7 +479,9 @@ static bool sasl_choose_oauth(struct Curl_easy *data, struct sasl_ctx *sctx) static bool sasl_choose_oauth2(struct Curl_easy *data, struct sasl_ctx *sctx) { - const char *oauth_bearer = data->set.str[STRING_BEARER]; + const char *oauth_bearer = + (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ? + data->set.str[STRING_BEARER] : NULL; if(sctx->user && oauth_bearer && (sctx->enabledmechs & SASL_MECH_XOAUTH2)) {