-3

From https://curl.haxx.se/docs/httpscripting.html

Curl's "cookie engine" gets enabled when you use the --cookie option. If you only want curl to understand received cookies, use --cookie with a file that doesn't exist. Example, if you want to let curl understand cookies from a page and follow a location (and thus possibly send back cookies it received), you can invoke it like:

curl --cookie nada --location http://www.example.com

What is the purpose of "use --cookie with a file that doesn't exist"?

What does "if you only want curl to understand received cookies" mean?

Thanks.

0

When you're using the -L option ("follow through 3XX redirects") and also using --cookie with a non-existing file, curl will sent in subsequent requests the cookies set in previous responses without storing them permanently anywhere.

Many sites will send you into infinite redirects if you don't accept their cookies; however, you don't want to store any state on disk and let them track you through separate curl invocations.

Example with a bogus --cookie file:

curl --cookie nada -v -L https://www.google.com/news -o /dev/null 2>&1 | egrep -i 'cookie|Connected to|^> GET|^< HTTP'

* Connected to www.google.com (2a00:1450:400d:803::2004) port 443 (#0)
> GET /news HTTP/1.1
< HTTP/2 302
* Added cookie NID="158=LONG-GARBAGE" for domain google.com, path /, expire 1564698265
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:25 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#1)
> GET /news HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 301
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#2)
> GET / HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 302
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#3)
> GET /?hl=en-US&gl=US&ceid=US:en HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 200

And without one:

curl -v -L https://www.google.com/news -o /dev/null 2>&1 | egrep -i 'cookie|Connected to|^> GET|^< HTTP'

* Connected to www.google.com (2a00:1450:400d:803::2004) port 443 (#0)
> GET /news HTTP/1.1
< HTTP/2 302
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#1)
> GET /news HTTP/1.1
< HTTP/2 301
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#2)
> GET / HTTP/1.1
< HTTP/2 302
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#3)
> GET /?hl=en-US&gl=US&ceid=US:en HTTP/1.1
< HTTP/2 200
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly

Notice how the second invocation ignores the cookies set in responses with set-cookie instead of sending them back in requests.

  • Thanks. Is --cookie without a real file only used when you're using the -L option ("follow through 3XX redirects")? – Tim Jan 30 at 23:45
  • " if you don't accept their cookies". how can you make curl not accept cookies? – Tim Jan 30 at 23:51
  • 1. -L is a case where curl does multiple requests in a single invocation; other case is where you're using curl with multiple urls. 2. by not using any --cookie option as I did in the 2nd example. "Accepting cookies" means sending them back in requests, in a Cookie: header. – mosvy Jan 30 at 23:59
  • If by "record" you mean copying the string somewhere so it could be sent back with subsequent requests, then, yes, you'll have to "record" it. The server doesn't know or care what you doing with it, as long as you're sending it back, so it could keep state and track you through multiple requests. This is already quite offtopic, but there's another method you could keep state in HTTP -- by encoding it in the url. The downside of that vs. cookies is that it's too obvious to the user ;-) – mosvy Jan 31 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.