1

From https://curl.haxx.se/docs/httpscripting.html

Curl's "cookie engine" gets enabled when you use the --cookie option. If you only want curl to understand received cookies, use --cookie with a file that doesn't exist. Example, if you want to let curl understand cookies from a page and follow a location (and thus possibly send back cookies it received), you can invoke it like:

curl --cookie nada --location http://www.example.com

What is the purpose of "use --cookie with a file that doesn't exist"?

What does "if you only want curl to understand received cookies" mean?

Thanks.

Improve this question

1 Answer 1

Reset to default
4

When you're using the -L option ("follow through 3XX redirects") and also using --cookie with a non-existing file, curl will sent in subsequent requests the cookies set in previous responses without storing them permanently anywhere. IMHO, instead of using a non-existing file, using --cookie /dev/null would be safer and will achieve the same effect.

Curl will not send back any cookies by default, unless the --cookie or --cookie-jar options were used. But many sites will send you into infinite redirects if you don't accept their cookies; however, you may not want to store any state on disk and let them track you through separate curl invocations.

Example with a bogus --cookie file:

curl --cookie nada -v -L https://www.google.com/news -o /dev/null 2>&1 | egrep -i 'cookie|Connected to|^> GET|^< HTTP'

* Connected to www.google.com (2a00:1450:400d:803::2004) port 443 (#0)
> GET /news HTTP/1.1
< HTTP/2 302
* Added cookie NID="158=LONG-GARBAGE" for domain google.com, path /, expire 1564698265
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:25 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#1)
> GET /news HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 301
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#2)
> GET / HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 302
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#3)
> GET /?hl=en-US&gl=US&ceid=US:en HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 200

And without one:

curl -v -L https://www.google.com/news -o /dev/null 2>&1 | egrep -i 'cookie|Connected to|^> GET|^< HTTP'

* Connected to www.google.com (2a00:1450:400d:803::2004) port 443 (#0)
> GET /news HTTP/1.1
< HTTP/2 302
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#1)
> GET /news HTTP/1.1
< HTTP/2 301
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#2)
> GET / HTTP/1.1
< HTTP/2 302
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#3)
> GET /?hl=en-US&gl=US&ceid=US:en HTTP/1.1
< HTTP/2 200
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly

Notice how the second invocation ignores the cookies set in responses with set-cookie instead of sending them back in requests.

Improve this answer
8
  • Thanks. Is --cookie without a real file only used when you're using the -L option ("follow through 3XX redirects")?
    – Tim
    Jan 30, 2019 at 23:45
  • 1
    " if you don't accept their cookies". how can you make curl not accept cookies?
    – Tim
    Jan 30, 2019 at 23:51
  • 1. -L is a case where curl does multiple requests in a single invocation; other case is where you're using curl with multiple urls. 2. by not using any --cookie option as I did in the 2nd example. "Accepting cookies" means sending them back in requests, in a Cookie: header.
    – user313992
    Jan 30, 2019 at 23:59
  • If by "record" you mean copying the string somewhere so it could be sent back with subsequent requests, then, yes, you'll have to "record" it. The server doesn't know or care what you doing with it, as long as you're sending it back, so it could keep state and track you through multiple requests. This is already quite offtopic, but there's another method you could keep state in HTTP -- by encoding it in the url. The downside of that vs. cookies is that it's too obvious to the user ;-)
    – user313992
    Jan 31, 2019 at 1:57
  • I second the question of how to make curl not accept cookies at all. Wget has the "--no-cookies" flag. Is there an equivalent in curl? Unless perhaps not accepting cookies is the default in curl.
    – SeligkeitIstInGott
    Apr 1, 2020 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .