When you're using the -L
option ("follow through 3XX redirects") and also using --cookie
with a non-existing file, curl
will sent in subsequent requests the cookies set in previous responses without storing them permanently anywhere. IMHO, instead of using a non-existing file, using --cookie /dev/null
would be safer and will achieve the same effect.
Curl will not send back any cookies by default, unless the --cookie
or --cookie-jar
options were used. But many sites will send you into infinite redirects if you don't accept their cookies; however, you may not want to store any state on disk and let them track you through separate curl
invocations.
Example with a bogus --cookie
file:
curl --cookie nada -v -L https://www.google.com/news -o /dev/null 2>&1 | egrep -i 'cookie|Connected to|^> GET|^< HTTP'
* Connected to www.google.com (2a00:1450:400d:803::2004) port 443 (#0)
> GET /news HTTP/1.1
< HTTP/2 302
* Added cookie NID="158=LONG-GARBAGE" for domain google.com, path /, expire 1564698265
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:25 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#1)
> GET /news HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 301
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#2)
> GET / HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 302
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#3)
> GET /?hl=en-US&gl=US&ceid=US:en HTTP/1.1
> Cookie: NID=158=LONG-GARBAGE
< HTTP/2 200
And without one:
curl -v -L https://www.google.com/news -o /dev/null 2>&1 | egrep -i 'cookie|Connected to|^> GET|^< HTTP'
* Connected to www.google.com (2a00:1450:400d:803::2004) port 443 (#0)
> GET /news HTTP/1.1
< HTTP/2 302
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#1)
> GET /news HTTP/1.1
< HTTP/2 301
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#2)
> GET / HTTP/1.1
< HTTP/2 302
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
* Connected to news.google.com (2a00:1450:400d:807::200e) port 443 (#3)
> GET /?hl=en-US&gl=US&ceid=US:en HTTP/1.1
< HTTP/2 200
< set-cookie: NID=158=LONG-GARBAGE;Domain=.google.com;Path=/;Expires=Thu, 01-Aug-2019 22:24:43 GMT;HttpOnly
Notice how the second invocation ignores the cookies set in responses with set-cookie
instead of sending them back in requests.