Question

When we send a http message with:

res= curl_easy_perform(curl);

How to detect the authentication failure from libcur in case that the http message was sent with wrong login or password?

I checked the value of res for both success and failure and I found it = to 0

Answer 1

curl_easy_perform will return 0 if the request went through successfully.

Bad authentication typically results in a 401 Unauthorized HTTP response code. However, cURL doesn’t count that as a request error. An example of request error is CURLE_URL_MALFORMAT, which would be returned if your request URL was incorrectly formatted, which would mean the request didn’t even hit the remote server.

Some may advise you to use CURLOPT_FAILONERROR to make curl_easy_perform fail if the response code is greater or equal to 400. However, the libcurl documentation expressly warns you about that:

This method is not fail-safe and there are occasions where non-successful response codes will slip through, especially when authentication is involved (response codes 401 and 407).

The proper way to check for authentication errors would be to use curl_easy_getinfo to fetch the HTTP response code, e.g.:

CURLcode res = curl_easy_perform(curl);
long httpCode = 0;
curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode);