30

Is curl -u username:password http://example.com secure?

If not, can you give a brief explanation of how someone could obtain your password?

3
  • 6
    if you are using that in a terminal have you in mind that both credentials are stored in history of bash? May 26, 2015 at 20:03
  • 15
    Such a command is not secure because another user might use ps -efto see which processes are running. When your curl -u username:password http://example.comappear in the list, your destination, username and password are compromised.
    – Lambert
    May 26, 2015 at 20:04
  • Although the question is on-topic here, you may also be interested in Information Security StackExchange
    – IQAndreas
    May 28, 2015 at 6:39

6 Answers 6

54

It is unsafe, because cURL defaults to basic authentication where HTTP protocol sends your password in clear text. When you specify the username:password string, it gets converted to a BASE64 string in the HTTP header:

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Anyone able to intercept your HTTP traffic (your provider, anyone accessing the same wireless AP as you etc) will be able to recover the password by simply using an online BASE64 converter.

HTTPS protocol will make things better by establishing an encrypted connection before this header is sent, preventing the password from being revealed. However, this only applies if the user pays attention when asked to confirm unknown certificates, authorize security exceptions and so on.

Note that command arguments might be available for other users on the same machine to see, e.g. ps -ef, /proc filesystem, in you bash history, and in your terminal log (thanks for @Lambert's comment noting this). cURL on some platforms attempts to hide the password so for example with ps -ef you are likely to see blank space instead of a password. However, instead of passing the password as a command line argument, having cURL directly prompt for a password is better, as discussed on the cURL faq.

10
  • 4
    Even if you're on a platform where curl successfully overwrites its own argv to hide data from ps, there's a period while it's starting up before that overwrite is performed where that content is vulnerable. May 27, 2015 at 0:25
  • What about digest authentication? Doesn't curl use that by default?
    – rr-
    May 27, 2015 at 9:58
  • 2
    @rr Digest authentication is just marginally better, as it does not prevent man-in-the-middle attacks, so you're still better off using HTTPS. May 27, 2015 at 10:10
  • 1
    @rr How do you assert StartSSL is not trusted by most browsers? Do you expect many Windows 95 or Firefox 1.5 users? May 27, 2015 at 20:10
  • 1
    @rr IMHO you get untrusted only if there's a problem with missing (or wrong) intermediate certs on the server May 27, 2015 at 20:19
24

It is not secure. Command line parameters are visible to all users.

7
  • 4
    Merging with @Dmitry Grigoryev answer it could be the most accurate one. May 26, 2015 at 20:10
  • 1
    Yeah, I completely missed the big part of the problem I must admit. May 26, 2015 at 20:18
  • command could be part of a script only readable by the user...
    – Pete
    May 26, 2015 at 23:35
  • 2
    @Pete command lines of executing programs (whether started from a script or at a terminal) are typically visible to all users through the ps command and the /proc file system. If the command finishes quickly, the risk is reduced, but it is still there.
    – RBerteig
    May 26, 2015 at 23:45
  • 2
    @Pete Answers are not supposed to be exclusive, they complement each other. So it's OK for the second answer to omit the threat explained in the first, rather, it would be redundant to repeat it. And I wouldn't call the statement false because it's not true in every case possible. May 27, 2015 at 21:33
1

This could be done in a more safer way by using --netrc-file parameter.

  1. Create a file with 600 permission

For eg: vi /root/my-file

machine example.com

login USERNAME

password PASSWORD

Save and Close the file

  1. Use the below to access the URL with Username and Password.

curl --netrc-file /root/my-file http://example.com

  1. Done
0

It is insecure when using HTTP scheme. To make it secure, you should use HTTPS.

To hide password from appearing in command history, only provide user name. Curl will prompt for password, if not provided in command.

1
  • Not a useful answer if HTTPS is not available. cURL is a "client".
    – mckenzm
    Apr 25, 2018 at 23:31
0

Short answer is no... but....

If there are no server side options you can harden the security.

  1. If this is local intranet then isolate the broadcast domain, and do not use WiFi or any radio.
  2. As Shameer says, use a .netrc file, keep the values out of the code.
  3. If you trust that memory is safe, use environmental vars. $PSWD.
  4. If this is automation, run from root's crontab.
  5. ...in a container.
  6. ...from a VM with an encrypted disk.

None of these are any less secure than a browser using HTTP.

0

Using a username and password in the command line with curl like this: curl -u username:password [https://www.wheelofnames.fun/][1] is generally considered insecure. The reason is that command-line arguments are often logged, and this could lead to exposing sensitive information (i.e., the password) to anyone with access to those logs.

Here are some reasons why this approach is insecure:

  1. Command-line history: Command-line history keeps a record of the commands you enter, and it may include your username and password. This poses a security risk, especially if other users have access to your account.

  2. Process listing: On some systems, running processes can be listed, and the username and password might be visible in the process list.

  3. Logs: Various system logs could inadvertently record the command-line arguments, potentially exposing the password.

A more secure approach is to use the -u option without specifying the password directly in the command. When you use -u username, curl will prompt you to enter the password securely without displaying it on the screen. For example:

curl -u username [https://www.wheelofnames.fun/][1]

After running this command, curl will prompt you to enter the password, providing a more secure way to pass credentials. Keep in mind that even this method may still leave traces in certain log files, so exercise caution when handling sensitive information.

For even more robust security, consider using environment variables or configuration files to store your credentials securely, and then reference those variables or files within your scripts or commands. This way, you can keep your credentials separate from your code and prevent accidental exposures.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .