The description of
Tells curl to figure out authentication method by itself, and use the most secure one the remote site claims
to support. This is done by first doing a request and checking the response-headers, thus possibly inducing an
extra network round-trip.
It works by sending the request with no authentication, and then determining from the response (a) whether another request is necessary and (b) which form of authentication it should use. The typical scenario is that the server responds to the request with a 401, with information in the headers indicating which types of authentication it will accept.
To be able to send the request twice,
curl needs to be able to re-read the data (it doesn’t memorise it) — this is what is meant by “rewind”. Pipes are not seekable, so a pipe used to feed data to
curl reading from its standard input means that
curl can’t re-read the input data, and thus
--anyauth can’t be used reliably.