PHP's cURL library doesn't allow following HTTP redirects when the server administrator has set open_basedir.
This has produced questions on SO like curl follow location error with a lot of duplicates, and most answers are either "switch to a hosting provider that allows turning off open_basedir" or abstraction inversions that attempt (with varying levels of quality) to reimplement cURL's HTTP redirect logic in PHP.
I just wonder why the PHP developers chose to make them mutually exclusive in the first place.
What security purpose does PHP's policy of refusing to follow redirects from one HTTP or HTTPS URI to another HTTP or HTTPS URI when the server administrator has set open_basedir serve?
