You can opt to either insert the user and password in the URL or you can provide them separately:

curl http://user:password@example.org/


curl -u user:password http://example.org/

Which methods does curl use in the two cases, GET or POST?

Does curl generate the same HTTP request in both cases? If not, which one is less secure?



GET v. POST has nothing to do with authentication. See When should I use GET or POST method? What's the difference between them?

In both cases here, curl uses basic authentication (the default) and a GET request. You can see exactly what curl does by adding the -v option: this will cause curl to display its requests and the responses it gets (limited to headers), in addition to the response body it outputs by default.

If you want to use a more secure authentication mechanism, you can specify it explicitly (--digest or --negotiate typically), or use the --anyauth option to tell curl to figure out the most secure authentication mechanism it can use.

  • docs: -X ... The specified request will be used instead of the method otherwise used (which defaults to GET). – Jeff Schaller Jan 30 at 13:47
  • Right, although usually you’d rely on curl doing the “right thing” depending on other options (e.g. it will automatically switch to POST if you add a -d or -F option). – Stephen Kitt Jan 30 at 13:53
  • Does "limited to headers" apply to response? -v will show the body of a response, correct? – Tim Jan 30 at 18:00
  • curl always the body of the response by default. -v specifies additional output. (I’ll update my answer.) – Stephen Kitt Jan 30 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.