Question

How secure is it, when you sending username and password with cURL –form or –data option? Compare to the browser form submitting, what’s the difference between them?

For example, how is the following different to a browser form?

curl –from username=fred –form password=secret http://example.com

Answer 1

Curl emulates a browser, so over the network they’re both the same, HTTP being insecure and HTTPS being mostly secure. The browser adds some extra headers that curl may not send by default, but it can be made to do so.

The problem with sending it using curl using that command is more local, if you’re unlucky and someone runs ps (or the task manager) at the wrong moment, may see your command line, including the password.