55

From cUrl docs:

-u, --user <user:password;options>

Specify the user name, password and optional login options to use for server authentication. Overrides -n, --netrc and --netrc-optional.

What it gets translated to, meaning how do I catch it on the server to authenticate the user: are they in GET or in POST parameters?

The language is not important, the idea is important.

3 Answers 3

71

It all depends on the authentication method but for the most common ones - Basic Auth and Digest Auth, this works with ad hoc HTTP headers. Here's an example with Basic Auth:

curl -u john:pwd http://foo.com/misc

This performs a GET request with the corresponding header:

GET /misc HTTP/1.1
Authorization: Basic am9objpwd2Q=
User-Agent: curl/7.33.0
Host: foo.com
Accept: */*

The Authorization header contains the authentication data the server is supposed to parse, base64 decode[1] and use. The same header would be set with a POST request. You can easily test it out with a service like httpbin(1) (see /basic-auth/:user/:passwd endpoint).

Digest auth is a bit more complex but works with HTTP headers too:

  • the client first send its request, the server replies with a 401 Unauthorized including a WWW-Authenticate header with a challenge to solve,
  • the client solves the challenge and send another request with the response included into a Authorization header which has to be parsed and validated on the server-side.

[1]: base64("john:pwd") -> am9objpwd2Q=

4
  • why do you use john:pwd 2 times in the command line for curl? Dec 23, 2013 at 10:33
  • Because this is how httpbin works: it is a simple service used to test HTTP clients, etc. It provides endpoints to test Basic and Digest auth provided that you precise which username and password to use. But you can forget this part which is specific to this testing service. I've updated my answer to avoid any ambiguity.
    – deltheil
    Dec 23, 2013 at 10:49
  • But my first question is how to get user and pass on the server. Dec 23, 2013 at 11:11
  • Once again it all depends on the auth scheme. With Basic Auth you must parse the Authorization header, base64 decode the encoded part and extract the user and password. Here's an example from Rails.
    – deltheil
    Dec 23, 2013 at 13:38
15

There is an easier way to do. Do it this way

curl "http://user:[email protected]"

1
  • Wow! Never knew about this. This is pretty powerful. Mar 20, 2023 at 15:16
5

In PHP/nginx, it's available in this array element as a base64 encoded string. It works both on GET and POST (curl -X POST ) methods.

$_SERVER['HTTP_AUTHORIZATION']

Request:

curl http://127.0.0.1:8080/test.php  -u arun:12345

value in $_SERVER['HTTP_AUTHORIZATION']:

Basic YXJ1bjoxMjM0NQ==
1
  • Thanks for this: -u in terms of headers means Basic. So e.g. in Postman I chose "Basic Auth" under Authentication, and, if only a token is provided, add it as username, leaving password empty. This will add Authorization header with Basic <hashed token> value
    – Denis
    Nov 22, 2022 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.