Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is -u flag on cURL actually doing?

Tags:

curl

I'm looking at Stripe's cURL example for getting info on an event.

They have me do:

curl https://api.stripe.com/v1/events/evt_123 \    -u sk_test_somekey: 

The documentation for cURL states that -u does USER:PASSWORD.

When I tried sending this as -d or as a query ?, Stripe's API says that I'm missing a header. This doesn't seem right.

I don't understand the lack of password after the username, either. If I send that cURL without the :, I am prompted for a password. Hitting enter (no characters inputted), gets me the expected response.

So, what exactly is -u doing so I can imitate this call in my code?

like image 310
quantumpotato Avatar asked Feb 16 '16 20:02

quantumpotato


People also ask

What does flag in curl do?

What is a flag in Curl? A flag is a command-line parameter that denotes a specific action in Curl. Curl has over three hundred command-line options, and the number of options increases over time. You can add the listed flags to the Curl command and enter the URL.

What does curl actually do?

curl (short for "Client URL") is a command line tool that enables data transfer over various network protocols. It communicates with a web or application server by specifying a relevant URL and the data that need to be sent or received. curl is powered by libcurl, a portable client-side URL transfer library.

What is curl O flag?

If you just run curl example.com, the code displays in your terminal. To save it to a new file name instead, use the -o flag. This uses the lowercase 'o' character. The syntax would be curl -o <new-file-with-saved-code> <website-url>

What does H mean in curl?

curl -H is a command line option for the curl command that takes a single parameter of an extra header to include in the request.


1 Answers

curl -u encodes the username:password string into a base-64 string which is passed in the Authorization header, like so:

GET / HTTP/1.1 Host: example.com Accept: text/html Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ= 

This isn't easy to skim, but it's not encryption either. Anyone with a base 64 decoder can see the username and password, so make sure you set up HTTPS.

Your HTTP library probably has a function that does this for you.

like image 50
Aaron Brager Avatar answered Oct 14 '22 07:10

Aaron Brager