{"id":8133,"date":"2015-09-11T14:54:10","date_gmt":"2015-09-11T12:54:10","guid":{"rendered":"http:\/\/daniel.haxx.se\/blog\/?p=8133"},"modified":"2022-11-09T13:24:58","modified_gmt":"2022-11-09T12:24:58","slug":"unnecessary-use-of-curl-x","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2015\/09\/11\/unnecessary-use-of-curl-x\/","title":{"rendered":"Unnecessary use of curl -X"},"content":{"rendered":"\n<p>I&#8217;ve grown a bit tired of the web filling up with curl command line examples showing use of superfluous -X&#8217;s. I&#8217;m putting code where my mouth is.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><a href=\"https:\/\/xkcd.com\/386\/\"><img decoding=\"async\" src=\"https:\/\/imgs.xkcd.com\/comics\/duty_calls.png\" alt=\"\"\/><\/a><\/figure>\n<\/div>\n\n\n<p>Starting with <a href=\"http:\/\/curl.haxx.se\/\">curl<\/a> 7.45.0 (due to ship October 7th 2015), the tool will help users to understand that their use of the <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#-X\"><code>-X<\/code><\/a> (or <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#-X\"><code>--request<\/code><\/a>) is very often unnecessary or even downright wrong. If you specify the same method with <code>-X<\/code> that will be used anyway, and you have <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#-v\">verbose mode<\/a> enabled, curl will inform you about it and gently push you to stop doing it.<\/p>\n\n\n\n<p>Example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ curl -I -XHEAD http:\/\/example.com --verbose<\/pre>\n\n\n\n<p>The option <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#-I\">dash capital i<\/a> means asking curl to issue a HEAD request. Adding <code>-X HEAD<\/code> to that command line asks for it <em>again<\/em>. This option sequence will now make curl say:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Note: Unnecessary use of -X or --request, HEAD is already inferred.<\/pre>\n\n\n\n<p>It&#8217;ll also inform the user similarly if you do <code>-XGET<\/code> on a normal fetch or <code>-XPOST<\/code> when using one of the -d options. Like this:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><p>$ curl -v -d hello -XPOST http:\/\/example.com\nNote: Unnecessary use of <code>-X<\/code> or <code>--request<\/code>, POST is already inferred.<\/p><\/pre>\n\n\n\n<p>curl will still continue to work exactly like before though, these are only informational texts that won&#8217;t alter any behaviors. Again, it only says this if verbose mode is enabled.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What -X does<\/h2>\n\n\n\n<p>When doing HTTP with curl, the -X option changes the actual method string in the HTTP request. That&#8217;s all it does. <strong>It does not change behavior accordingly<\/strong>. It&#8217;s the perfect option when you want to send a <a href=\"https:\/\/tools.ietf.org\/html\/rfc7231#section-4.3.5\">DELETE<\/a> method or <a href=\"https:\/\/tools.ietf.org\/html\/rfc7231#section-4.3.8\">TRACE<\/a> or similar that curl has no native support for and you want to send easily. You can use it to make curl send a GET with a request-body or you can use it to have the <code>-d<\/code> option work even when you want to send a PUT. All good uses.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why superfluous -X usage is bad<\/h2>\n\n\n\n<p>I know several users out there will disagree with this. That&#8217;s also why this is only shown in verbose mode and it only says &#8220;Note:&#8221; about it. For now.<\/p>\n\n\n\n<p>There are a few problems with the superfluous uses of -X in curl:<\/p>\n\n\n\n<p>One of most obvious problems is that if you also tell curl to follow HTTP redirects (using <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#-L\"><code>-L<\/code> or <code>--location<\/code><\/a>), the <code>-X<\/code> option will also be used&nbsp; on the redirected-to requests which may not at all be what the server asks for and the user expected. Dropping the -X will make curl adhere to what the server asks for. And if you want to alter what method to use in a redirect, curl already have dedicated options for that named <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#--post301\"><code>--post301<\/code><\/a>, <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#--post302\"><code>--post302<\/code><\/a> and <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#--post303\"><code>--post303<\/code><\/a>!<\/p>\n\n\n\n<p>But even without following redirects, just throwing in an extra <code>-X<\/code> &#8220;to clarify&#8221; leads users into believing that -X has a function to serve there when it doesn&#8217;t. It leads the user to use that <code>-X<\/code> in his or her&#8217;s next command line too, which then <em>may<\/em> use redirects or something else that makes it unsuitable.<\/p>\n\n\n\n<p>The perhaps biggest mistake you can do with <code>-X<\/code>, and one that now actually leads to curl showing a &#8220;warning&#8221;, is if you&#8217;d use <code>-XHEAD<\/code> on an ordinary command line (that isn&#8217;t using <a href=\"http:\/\/curl.haxx.se\/docs\/manpage.html#-I\"><code>-I<\/code><\/a>). Like this (I&#8217;ll display it crossed over to make it abundantly clear that this is a <strong>bad<\/strong> command line):<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><s>$ curl -XHEAD http:\/\/example.com\/<\/s><\/pre>\n\n\n\n<p>&#8230; which will have curl act as if it sends a <a href=\"https:\/\/tools.ietf.org\/html\/rfc7231#section-4.3.1\">GET<\/a> but it sends a HEAD. A response to a <a href=\"https:\/\/tools.ietf.org\/html\/rfc7231#section-4.3.2\">HEAD<\/a> never has a body, although it sends the size of the body exactly like a GET response which thus mostly will lead to curl to sit there waiting for the response body to arrive when it simply won&#8217;t and it&#8217;ll hang.<\/p>\n\n\n\n<p>Starting with this change, this is the warning it&#8217;ll show for the above command line:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>Warning: Setting custom HTTP method to HEAD may not work the way you want.<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve grown a bit tired of the web filling up with curl command line examples showing use of superfluous -X&#8217;s. I&#8217;m putting code where my mouth is. Starting with curl 7.45.0 (due to ship October 7th 2015), the tool will help users to understand that their use of the -X (or &#8211;request) is very often &hellip; <a href=\"https:\/\/daniel.haxx.se\/blog\/2015\/09\/11\/unnecessary-use-of-curl-x\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Unnecessary use of curl -X<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[214,33],"class_list":["post-8133","post","type-post","status-publish","format-standard","hentry","category-curl","tag-command-line","tag-curl-and-libcurl"],"_links":{"self":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/8133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/comments?post=8133"}],"version-history":[{"count":27,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/8133\/revisions"}],"predecessor-version":[{"id":20658,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/8133\/revisions\/20658"}],"wp:attachment":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media?parent=8133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/categories?post=8133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/tags?post=8133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}