GNURLOPT_HTTPAUTH(3)

🌸 NAME 🌸

Okay bestie, this is the GNURLOPT_HTTPAUTH(3) page, and it's literally about the CURLOPT_HTTPAUTH option — the one that sets the HTTP server authentication methods libcurl should try. 🫶

✨ SYNOPSIS ✨

#include <gnurl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPAUTH, long bitmask);

💅 DESCRIPTION 💅

So you pass a long as the parameter, and it's set to a bitmask that tells libcurl which authentication method or methods you want it to use when it's speaking to the remote server. No cap.

The available bits are listed below, bestie. If more than one bit is set, libcurl will first query the site to see which authentication methods it supports, and then pick the best one you allow it to use. For some methods, this will induce an extra network round-trip. Set the actual name and password with the CURLOPT_USERPWD(3) option, or with the CURLOPT_USERNAME(3) and the CURLOPT_PASSWORD(3) options.

For authentication with a proxy, see CURLOPT_PROXYAUTH(3).

🎀 The auth bits 🎀

• CURLAUTH_BASIC — HTTP Basic authentication. This is the default choice, and the only method that is in wide-spread use and supported virtually everywhere. It sends the user name and password over the network in plain text, easily captured by others. Yes, literally plain text — protect that vibe accordingly. 💀
• CURLAUTH_DIGEST — HTTP Digest authentication. Digest authentication is defined in RFC2617 and is a more secure way to do authentication over public networks than the regular old-fashioned Basic method. Slay for public networks. ✨
• CURLAUTH_DIGEST_IE — HTTP Digest authentication with an IE flavor. Digest authentication is defined in RFC2617 and is a more secure way to do authentication over public networks than the regular old-fashioned Basic method. The IE flavor is simply that libcurl will use a special "quirk" that IE is known to have used before version 7 and that some servers require the client to use. Server said “be quirky,” so libcurl is quirky. 🙈
• CURLAUTH_BEARER — HTTP Bearer token authentication, used primarily in OAuth 2.0 protocol. You can set the Bearer token to use with CURLOPT_XOAUTH2_BEARER(3). Token energy. 🔥
• CURLAUTH_NEGOTIATE — HTTP Negotiate (SPNEGO) authentication. Negotiate authentication is defined in RFC 4559 and is the most secure way to perform authentication over HTTP. You need to build libcurl with a suitable GSS-API library or SSPI on Windows for this to work. Main-character security, but only if your build is set up right. 👑
• CURLAUTH_NTLM — HTTP NTLM authentication. A proprietary protocol invented and used by Microsoft. It uses a challenge-response and hash concept similar to Digest, to prevent the password from being eavesdropped. You need to build libcurl with either OpenSSL, GnuTLS or NSS support for this option to work, or build libcurl on Windows with SSPI support. Microsoft lore, but make sure the build supports it. 🧚
• CURLAUTH_NTLM_WB — NTLM delegating to winbind helper. Authentication is performed by a separate binary application that is executed when needed. The name of the application is specified at compile time but is typically /usr/bin/ntlm_auth. Note that libcurl will fork when necessary to run the winbind application and kill it when complete, calling waitpid() to await its exit when done. On POSIX operating systems, killing the process will cause a SIGCHLD signal to be raised (regardless of whether CURLOPT_NOSIGNAL(3) is set), which must be handled intelligently by the application. In particular, the application must not unconditionally call wait() in its SIGCHLD signal handler to avoid being subject to a race condition. This behavior is subject to change in future versions of libcurl. This one has lore and a warning attached, bestie — handle the signal intelligently. 😭
• CURLAUTH_ANY — This is a convenience macro that sets all bits and thus makes libcurl pick any it finds suitable. libcurl will automatically select the one it finds most secure. It's giving “you choose, I trust your judgment.” 💖
• CURLAUTH_ANYSAFE — This is a convenience macro that sets all bits except Basic and thus makes libcurl pick any it finds suitable. libcurl will automatically select the one it finds most secure. Same energy as CURLAUTH_ANY, but Basic is not invited to the group chat. 💅
• CURLAUTH_ONLY — This is a meta symbol. OR this value together with a single specific auth value to force libcurl to probe for un-restricted auth and if not, only that single auth algorithm is acceptable. Meta symbol behavior — iykyk. 🌀

🌈 DEFAULT 🌈

CURLAUTH_BASIC

🦋 PROTOCOLS 🦋

HTTP

⭐ EXAMPLE ⭐

CURL *curl = curl_easy_init();
if(curl) {
  CURLcode ret;
  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
  /* allow whatever auth the server speaks */
  curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
  curl_easy_setopt(curl, CURLOPT_USERPWD, "james:bond");
  ret = curl_easy_perform(curl);
}

🧚 AVAILABILITY 🧚

Option Added in 7.10.6.

CURLAUTH_DIGEST_IE was added in 7.19.3

CURLAUTH_ONLY was added in 7.21.3

CURLAUTH_NTLM_WB was added in 7.22.0

CURLAUTH_BEARER was added in 7.61.0

🍓 RETURN VALUE 🍓

Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or CURLE_NOT_BUILT_IN if the bitmask specified no supported authentication methods. Literally the vibe check in return-code form. 😌

🎀 SEE ALSO 🎀

• CURLOPT_PROXYAUTH(3)
• CURLOPT_USERPWD(3)

---

Later, bestie — this page is from the libcurl 7.38.0 era, dated 2 Aug 2014, and you already know it's GNURLOPT_HTTPAUTH(3). mwah 💋