cUrls’s option “-u”

by

It all depends on the authentication method but for the most common ones – Basic Auth and Digest Auth, this works with ad hoc HTTP headers. Here’s an example with Basic Auth:

curl -u john:pwd http://foo.com/misc

This performs a GET request with the corresponding header:

GET /misc HTTP/1.1
Authorization: Basic am9objpwd2Q=
User-Agent: curl/7.33.0
Host: foo.com
Accept: */*

The Authorization header contains the authentication data the server is supposed to parse, base64 decode[1] and use. The same header would be set with a POST request. You can easily test it out with a service like httpbin(1) (see /basic-auth/:user/:passwd endpoint).

Digest auth is a bit more complex but works with HTTP headers too:

  • the client first send its request, the server replies with a 401 Unauthorized including a WWW-Authenticate header with a challenge to solve,
  • the client solves the challenge and send another request with the response included into a Authorization header which has to be parsed and validated on the server-side.

[1]: base64("john:pwd") -> am9objpwd2Q=

Leave a Comment