Is curl -u username:password http://example.com secure?

If not, can you give a brief explanation of how someone could obtain your password?

  • 5
    if you are using that in a terminal have you in mind that both credentials are stored in history of bash? – Francisco Tapia May 26 '15 at 20:03
  • 13
    Such a command is not secure because another user might use ps -efto see which processes are running. When your curl -u username:password http://example.comappear in the list, your destination, username and password are compromised. – Lambert May 26 '15 at 20:04
  • Although the question is on-topic here, you may also be interested in Information Security StackExchange – IQAndreas May 28 '15 at 6:39
up vote 52 down vote accepted

It is unsafe, because cURL defaults to basic authentication where HTTP protocol sends your password in clear text. When you specify the username:password string, it gets converted to a BASE64 string in the HTTP header:

GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Anyone able to intercept your HTTP traffic (your provider, anyone accessing the same wireless AP as you etc) will be able to recover the password by simply using an online BASE64 converter.

HTTPS protocol will make things better by establishing an encrypted connection before this header is sent, preventing the password from being revealed. However, this only applies if the user pays attention when asked to confirm unknown certificates, authorize security exceptions and so on.

Note that command arguments might be available for other users on the same machine to see, e.g. ps -ef, /proc filesystem, in you bash history, and in your terminal log (thanks for @Lambert's comment noting this). cURL on some platforms attempts to hide the password so for example with ps -ef you are likely to see blank space instead of a password. However, instead of passing the password as a command line argument, having cURL directly prompt for a password is better, as discussed on the cURL faq.

  • 4
    Even if you're on a platform where curl successfully overwrites its own argv to hide data from ps, there's a period while it's starting up before that overwrite is performed where that content is vulnerable. – Charles Duffy May 27 '15 at 0:25
  • What about digest authentication? Doesn't curl use that by default? – rr- May 27 '15 at 9:58
  • 2
    @rr Digest authentication is just marginally better, as it does not prevent man-in-the-middle attacks, so you're still better off using HTTPS. – Dmitry Grigoryev May 27 '15 at 10:10
  • 1
    @rr How do you assert StartSSL is not trusted by most browsers? Do you expect many Windows 95 or Firefox 1.5 users? – Hagen von Eitzen May 27 '15 at 20:10
  • 1
    @rr IMHO you get untrusted only if there's a problem with missing (or wrong) intermediate certs on the server – Hagen von Eitzen May 27 '15 at 20:19

It is not secure. Command line parameters are visible to all users.

  • 4
    Merging with @Dmitry Grigoryev answer it could be the most accurate one. – Francisco Tapia May 26 '15 at 20:10
  • 1
    Yeah, I completely missed the big part of the problem I must admit. – Dmitry Grigoryev May 26 '15 at 20:18
  • command could be part of a script only readable by the user... – Pete May 26 '15 at 23:35
  • 2
    @Pete command lines of executing programs (whether started from a script or at a terminal) are typically visible to all users through the ps command and the /proc file system. If the command finishes quickly, the risk is reduced, but it is still there. – RBerteig May 26 '15 at 23:45
  • 2
    @Pete Answers are not supposed to be exclusive, they complement each other. So it's OK for the second answer to omit the threat explained in the first, rather, it would be redundant to repeat it. And I wouldn't call the statement false because it's not true in every case possible. – Dmitry Grigoryev May 27 '15 at 21:33

This could be done in a more safer way by using --netrc-file parameter.

  1. Create a file with 600 permission

For eg: vi /root/my-file

machine example.com

login USERNAME

password PASSWORD

Save and Close the file

  1. Use the below to access the URL with Username and Password.

curl --netrc-file /root/my-file http://example.com

  1. Done

It is insecure when using HTTP scheme. To make it secure, you should use HTTPS.

To hide password from appearing in command history, only provide user name. Curl will prompt for password, if not provided in command.

  • Not a useful answer if HTTPS is not available. cURL is a "client". – mckenzm Apr 25 at 23:31

Short answer is no... but....

If there are no server side options you can harden the security.

  1. If this is local intranet then isolate the broadcast domain, and do not use WiFi or any radio.
  2. As Shameer says, use a .netrc file, keep the values out of the code.
  3. If you trust that memory is safe, use environmental vars. $PSWD.
  4. If this is automation, run from root's crontab.
  5. ...in a container.
  6. ...from a VM with an encrypted disk.

None of these are any less secure than a browser using HTTP.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.