CURLOPT_URL(3)

📦
version 8.18.0 · 23 versions
, in fedora 44

CURLOPT_URL(3) 💖

okay bestie, welcome to the Library Functions Manual — today’s main character is CURLOPT_URL, aka the URL for this transfer. grab a strawberry drink, we’re doing URL lore 🍓✨

🎀 NAME 🎀

CURLOPT_URL — URL for this transfer.

no cap, that’s the whole name. the URL. for the transfer. iconic.

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_URL, char *URL);

💅 DESCRIPTION 💅

Pass in a pointer to the URL you wanna work with. The parameter should be a char * to a null-terminated string, and that string must be URL-encoded in this format:

scheme://host:port/path

For a greater explanation of the format, please see RFC 3986. yes, the whole RFC — she’s long, but she’s thorough 🫶

libcurl does not validate the syntax or use the URL until the transfer is started. So even if you set a truly unhinged value here, curl_easy_setopt(3) might still return CURLE_OK. 💀 not me finding out later

If the given URL is missing a scheme name (such as "http://" or "ftp://", etc.) then libcurl guesses based on the host. If the outermost subdomain name matches DICT, FTP, IMAP, LDAP, POP3 or SMTP, then that protocol gets used; otherwise HTTP is used. Since 7.45.0, guessing can be disabled by setting a default protocol — see CURLOPT_DEFAULT_PROTOCOL(3) for details.

Should the protocol — either as specified by the URL scheme or deduced by libcurl from the hostname — not be supported by libcurl, then CURLE_UNSUPPORTED_PROTOCOL is returned from either the curl_easy_perform(3) or curl_multi_perform(3) functions when you call them. Use curl_version_info(3) for detailed information about which protocols are supported by the build of libcurl you’re using.

CURLOPT_PROTOCOLS_STR(3) can be used to limit what protocols libcurl may use for this transfer, independent of what libcurl has been compiled to support. That’s lowkey useful if you accept the URL from an external source and wanna limit the accessibility.

The CURLOPT_URL(3) string is ignored if CURLOPT_CURLU(3) is set. important!! Either CURLOPT_URL(3) or CURLOPT_CURLU(3) must be set before a transfer is started. do not skip this 🙈

The application does not have to keep the string around after setting this option. set it and forget it, bestie ✨

Using this option multiple times makes the last set string override the previous ones. Set it to NULL to disable its use again — but note that libcurl needs a URL set to be able to perform a transfer. so don’t ghost it completely and then expect a connection 😭

The parser used for handling the URL set with CURLOPT_URL(3) is the same one that curl_url_set(3) uses. same parser, same vibe, periodt.

🌈 ENCODING 🌈

The string pointed to in the CURLOPT_URL(3) argument is generally expected to be a sequence of characters using an ASCII compatible encoding.

If libcurl is built with IDN support, the server name part of the URL can use an “international name” by using the current encoding (according to locale) or UTF-8 (when WinIDN is used; or a Windows Unicode build using libidn2).

If libcurl is built without IDN support, the server name is used exactly as specified when passed to the name resolver functions. no edits, no cute little name tweaks 🎀

🦋 DEFAULT 🦋

NULL. If this option is not set, no transfer can be performed. that’s it. that’s the default. 💀

🔥 SECURITY CONCERNS 🔥

Applications may at times find it convenient to allow users to specify URLs for various purposes, and that string would then end up fed to this option.

Getting a URL from an external untrusted party brings several security concerns:

  • If you have an application that runs as or in a server application, getting an unfiltered URL can easily trick your application to access a local resource instead of a remote one. Protecting yourself against localhost accesses is hard when accepting user-provided URLs.
  • Such custom URLs can also access other ports than you planned, because port numbers are part of the regular URL format. The combination of a local host and a custom port number can allow external users to play tricks with your local services.
  • Accepting external URLs may also use other protocols than http:// or other common ones. Restrict what you accept with CURLOPT_PROTOCOLS_STR(3).
  • User-provided URLs can also be made to point to sites that redirect further on (possibly to other protocols too). Consider your CURLOPT_FOLLOWLOCATION(3) and CURLOPT_REDIR_PROTOCOLS_STR(3) settings.
bestie, this is the part where you do NOT just trust random URLs from the internet. please. i’m begging. 🫶

🌸 PROTOCOLS 🌸

This functionality affects all supported protocols. all of them. periodt.

💜 EXAMPLE 💜

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");

    curl_easy_perform(curl);
  }
}

⭐ AVAILABILITY ⭐

Added in curl 7.1.

👑 RETURN VALUE 👑

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK; non-zero means an error occurred — see libcurl-errors(3).

Note that curl_easy_setopt(3) does not parse the given string, so if you give it a bad URL, it is not detected until curl_easy_perform(3) or similar is called. yeah. she waits. 🙈

🧚 SEE ALSO 🧚

that’s the whole page, bestie — brought to you by libcurl and dated 2026-10-12, straight from the Library Functions Manual 💖✨ slay and use your URLs responsibly 🎀🦋

📦 where this page comes from