Search code examples
curlspring-securitypassword-encryption

Does cURL encrypt user's credentials?

I just developed a simple Spring RESTful web-service with Spring Security (Basic Authentication), therefore I would like to use cURL as a consumer.

BUT, when I execute this command in the command line prompt:

 curl -u myUsername host/securedResource

I asked to enter the password for that user, which I do. but no thing happened. in other words, I do not receive the data, and the container says, in its log, Access denied 403.

since the passwords are unencrypted in the database, does cURL encrypt the credentials? If yes, which encrypting method does it use? Or it sends them in clear text, by then, whats wrong in my command?

Solution

  • curl is simply a tool to invoke HTTP methods, it doesn't do anything different than a regular HTTP Basic authorization.

    Username and password in HTTP Basic auth is sent un-encrypted in Base64 encoding. You might want to read more about it.