Why does CURL's PUT fail authentication before uploading the payload, but XHR PUT only after?
When curl has a PUT request with authentication required, it first sends a “probe” with no content to allow the server the opportunity to refuse the connection before any data gets sent.
This doesn’t seem to be documented anywhere other than a comment in the code in Curl_http() in lib/http.c.
(Note that in versions of curl prior to 7.53.0 (2017‑02‑22, i.e. newer than the question), there was a bug whereby the user-supplied Content‑Length header (or no header) was sent instead of Content‑Length: 0.)
XHR implements no such probe and simply sends all the content with the initial request.
Try adding -H "Expect:" to your curl command.
I might be wrong but here's my hunch:
- XHR: Expect is a forbidden header name
- curl: adds
Expect: 100-continueby default