-1

I've been trying to make this work for a while now, and I just can't see why it's not working. It's just a simple script that's supposed to return either 200 (if it works) or 400 (if it doesn't). The trouble seems to come when I use variables to substitute values in Curl, example of a working curl:

curl --max-time 10 --write-out '%{http_code}' --silent --output '/dev/null' \
--insecure -X GET https://url -H \
**'authorization: bearer iUhYMrTBdx1GG97Bd99YqrbPojInugjTTnqT8TiRjqgZrZYynljfKpgfao'** \
--header 'content-type: application/json' --header \
"requestid: '999993122349238343493843958345'"

This works as expected and returns 200. When I replace the authorization bearer section in the following way I get a 400:

curl --max-time 10 --write-out '%{http_code}' --silent --output '/dev/null' \
--insecure -X GET https://url -H "authorization: bearer $TOKEN" --header \
'content-type: application/json' --header \
"requestid: '999993122349238343493843958345'"

I tried literally everything. Using the variable as "${TOKEN}", doing "'authorization: bearer $TOKEN'", even something similar to "'"'"'$TOKEN'"'"'". I don't know what else to try. When I remove the silent curl option I see the following error:

 400ODY></HTML>ror 400. The request is badly formed.</p>rset=us-ascii"></HEAD>trict.dtd">

I'm lost to why it works with plain text and not variables. Any ideas?

Edit: Added verbose for both:

> GET /REDACTED-URL HTTP/1.1
> Host: hostname:44301
> User-Agent: curl/7.50.3
> Accept: */*
> authorization: bearer eyJ0eXA700JKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImF1bkM2QV9MbHFVZGNYV3Z6UzVGOURQUEFTSSIsImtpZCI6ImF1bkM2QV9MbHFVZGNYV3Z6UzVGOURQUEFTSSJ9.eyJpc3MiOiJodHRwczovL0dQLUlEUzo0NDMwMS9HUC5JRFMiLCJhdWQiOiJodHRwczovL0dQLUlEUzo0NDMwMS9HUC5JRFMvcmVzb3VyY2VzIiwiZXhwIjoxNTUyNDI5MTA1LCJuYmYiOjE1NTI0MjU1MDUsImNsaWVudF9pZCI6Ik1FUkNBRE9MSUJSRUlWUiIsImNsaWVudF9NYXJjYSI6IjEiLCJjbGllbnRfVXN1YUNvZGkiOiJEQk8iLCJjbGllbnRfVmFsaWRhRXN0YWRvQ3VlbnRhIjoiMCIsImNsaWVudF9FbnRpZGFkIjoiMzAiLCJzY29wZSI6IlByZXBhZ2FBcGkifQ.kkCGp3EJ7VkvR75Zt0MV5VRmNVf-jP5dcb7GaZF6nI5KGNUxfx_linht3nUUX4Hw55ZKhfkiUhYMrTBdx1GG97Bd99YqrbPojInugjTTnqT8TiRjqgZrZYynljfKpgfaofoBnK0EWgqsQxcxPNre2PkvxWV-x6AzPl_uVWml1Wo2bjAi37kVklYmjkbBIWe8EcyF90MMR28xcipIo2ULj5HgOizhvokPg1qDEiYetTU2MYJ1fFRVgJ5v7KF0mpUk7zBl9dvFeGT3MPfTN9EED4biqE-zRaC0r8DK7lr1PScfVHqs09sI89PXTN9Nm2lOT6c43CsUy-YhylhjJr6AfIARcFv1o0-gy0nKnWxSBYnt8NgK7rZCfpjFDUfmaYL5IXqirob98L0cWfvnV3iL6R73dNciayRDy6PqZG0sHWhKkggBIOhRqh-7VsY99qCqG76Beih-UqWPcWO_H8-4zvYDslsXMj8ff1Nk76h9pxuy-qAkRapNVAbBojf41JFVVaONqgPCH9Jszq7cpFbX6vbVq18p6hOhDb4BhuTDkT6tB30RXQWaSPqRbRs2h7VYIcuxok6wbrBzGA32hBHiSVSQs0PdheJlVy1EcHy27MJuIj_Vs6bsiq0a4GY-scs4A-68fvzsERfsLLINDrS4C9zY1f6RwfEkDsWlQ1ouBIk
> content-type: application/json
> requestid: '999993245235232323523523523535'
>
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=utf-8
< Server: Microsoft-IIS/10.0
< requestid: '999993245235232323523523523535'
< CorrelationId: 3859af6f-4c8f-438c-bcfe-37ab6ecc0d6b
< RequestId: 9999af6f-4c8f-438c-bcfe-37ab6ecc0d6b
< X-Powered-By: ASP.NET
< Date: Tue, 12 Mar 2019 22:10:39 GMT
< Content-Length: 992
<
{ [992 bytes data]

This works ^

> GET /REDACTED-URL HTTP/1.1
> Host: hostname:44301
> User-Agent: curl/7.50.3
> Accept: */*
> authorization: bearer eyJ0eXA700JKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImF1bkM2QV9MbHFVZGNYV3Z6UzVGOURQUEFTSSIsImtpZCI6ImF1bkM2QV9MbHFVZGNYV3Z6UzVGOURQUEFTSSJ9.eyJpc3MiOiJodHRwczovL0dQLUlEUzo0NDMwMS9HUC5JRFMiLCJhdWQiOiJodHRwczovL0dQLUlEUzo0NDMwMS9HUC5JRFMvcmVzb3VyY2VzIiwiZXhwIjoxNTUyNDI5MTA1LCJuYmYiOjE1NTI0MjU1MDUsImNsaWVudF9pZCI6Ik1FUkNBRE9MSUJSRUlWUiIsImNsaWVudF9NYXJjYSI6IjEiLCJjbGllbnRfVXN1YUNvZGkiOiJEQk8iLCJjbGllbnRfVmFsaWRhRXN0YWRvQ3VlbnRhIjoiMCIsImNsaWVudF9FbnRpZGFkIjoiMzAiLCJzY29wZSI6IlByZXBhZ2FBcGkifQ.kkCGp3EJ7VkvR75Zt0MV5VRmNVf-jP5dcb7GaZF6nI5KGNUxfx_linht3nUUX4Hw55ZKhfkiUhYMrTBdx1GG97Bd99YqrbPojInugjTTnqT8TiRjqgZrZYynljfKpgfaofoBnK0EWgqsQxcxPNre2PkvxWV-x6AzPl_uVWml1Wo2bjAi37kVklYmjkbBIWe8EcyF90MMR28xcipIo2ULj5HgOizhvokPg1qDEiYetTU2MYJ1fFRVgJ5v7KF0mpUk7zBl9dvFeGT3MPfTN9EED4biqE-zRaC0r8DK7lr1PScfVHqs09sI89PXTN9Nm2lOT6c43CsUy-YhylhjJr6AfIARcFv1o0-gy0nKnWxSBYnt8NgK7rZCfpjFDUfmaYL5IXqirob98L0cWfvnV3iL6R73dNciayRDy6PqZG0sHWhKkggBIOhRqh-7VsY99qCqG76Beih-UqWPcWO_H8-4zvYDslsXMj8ff1Nk76h9pxuy-qAkRapNVAbBojf41JFVVaONqgPCH9Jszq7cpFbX6vbVq18p6hOhDb4BhuTDkT6tB30RXQWaSPqRbRs2h7VYIcuxok6wbrBzGA32hBHiSVSQs0PdheJlVy1EcHy27MJuIj_Vs6bsiq0a4GY-scs4A-68fvzsERfsLLINDrS4C9zY1f6RwfEkDsWlQ1ouBIk
> content-type: application/json
> requestid: '99999324523523534395600'
>
< HTTP/1.1 400 Bad Request
< Content-Type: text/html; charset=us-ascii
< Server: Microsoft-HTTPAPI/2.0
< Date: Tue, 12 Mar 2019 22:11:42 GMT
< Connection: close
< Content-Length: 311
<
{ [311 bytes data]

This doesn't. Same exact headers.

UPDATE: Having the same issue with wget:

With plain text:

  HTTP/1.1 200 OK
  Content-Type: application/json; charset=utf-8
  Server: Microsoft-IIS/10.0
  requestid: 9987993245235235345225233335324324
  CorrelationId: ee516440-af87-4aab-a5fa-5e563338a0be
  RequestId: ee516440-af87-4aab-a5fa-5e563338a0be
  X-Powered-By: ASP.NET
  Date: Thu, 14 Mar 2019 21:53:16 GMT
  Content-Length: 992

With variable:

  HTTP/1.1 400 Bad Request
  Content-Type: text/html; charset=us-ascii
  Server: Microsoft-HTTPAPI/2.0
  Date: Thu, 14 Mar 2019 21:54:16 GMT
  Connection: close
  Content-Length: 311
  • How did you set TOKEN? If you use set -x and then run the curl command, what does the shell show as the argument to -H? – ilkkachu Mar 12 at 21:35
  • $TOKEN was set just plainly on top of the script as: TOKEN="iUhYMrTBdx1GG97Bd99YqrbPojInugjTTnqT8TiRjqgZrZYynljfKpgfao" – Rodrigo Mar 12 at 22:03
  • well yeah, it looks like it should work, so that's why I asked about what set -x shows. You are sure that you used double quotes around the "authorization: bearer $TOKEN" as you have posted here, and not single quotes, right? – ilkkachu Mar 12 at 22:12
  • Absolutely sure. I tried all combinations anyway, I updated the post showing that the headers are being passed identically as text, yet when I use the variable it fails. – Rodrigo Mar 12 at 22:27
  • Ok. What about invisible characters like non-breaking spaces or CRLF line endings? If curl doesn't show them specially in the output, you wouldn't see them, but the variable assignment might have one in the end. Though with CRLF, you'd probably have the whole file with those line endings anyway, and then the version that doesn't use a variable wouldn't work either. – ilkkachu Mar 13 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.