Changes for version 6.83 - 2026-05-12

  • LWP::UserAgent now strips Authorization and Proxy-Authorization headers on cross-origin redirects (a different scheme, host, or port) to prevent credential leakage to the redirect target. Same-origin redirects retain credentials. Opt out with allow_credentialed_redirects => 1. CVE-2026-8368 reported by Kai Zen; PoC and initial patch by Stig Palmquist.
  • LWP::UserAgent now refuses https to http redirects by default to prevent leaking remaining request headers and bodies over plaintext. Opt in with allow_downgrade => 1. Related hardening alongside CVE-2026-8368; PoC by Stig Palmquist.

Documentation

Fetch large files from the web
See what headers and content is returned for a URL
Simple mirror utility
Simple command line user agent
The libwww-perl cookbook
An LWP Tutorial

Modules

LWP
The World-Wide Web library for Perl
Library for enabling NTLM authentication (Microsoft) in LWP
Connection cache manager
deprecated
Member access mixin class
Base class for LWP protocols
a class for well-behaved Web robots
simple procedural interface to LWP
Web user agent class

Provides

in lib/LWP/Authen/Basic.pm
in lib/LWP/Authen/Digest.pm
in lib/LWP/Debug/TraceHTTP.pm
in lib/LWP/DebugFile.pm
in lib/LWP/Protocol/cpan.pm
in lib/LWP/Protocol/data.pm
in lib/LWP/Protocol/file.pm
in lib/LWP/Protocol/ftp.pm
in lib/LWP/Protocol/gopher.pm
in lib/LWP/Protocol/http.pm
in lib/LWP/Protocol/loopback.pm
in lib/LWP/Protocol/mailto.pm
in lib/LWP/Protocol/nntp.pm
in lib/LWP/Protocol/nogo.pm