title: Why was CURLOPT_FOLLOWLOCATION made incompatible with open_basedir?
body: <p>PHP's cURL library doesn't allow following HTTP redirects when the server administrator has set <code>open_basedir</code>.
  This has produced questions on SO like <a href="https://stackoverflow.com/questions/2511410/curl-follow-location-error">curl follow location error</a> with a lot of duplicates, and most answers are either "switch to a hosting provider that allows turning off <code>open_basedir</code>" or <a href="https://en.wikipedia.org/wiki/Abstraction_inversion" rel="nofollow noreferrer">abstraction inversions</a> that attempt (with varying levels of quality) to reimplement cURL's HTTP redirect logic in PHP.</p>
  
  <p>I just wonder why the PHP developers chose to make them mutually exclusive in the first place.
  What security purpose does PHP's policy of refusing to follow redirects from one HTTP or HTTPS URI to another HTTP or HTTPS URI when the server administrator has set <code>open_basedir</code> serve?</p>