TIPS - Curl : Différence entre versions
De PedroWiki
(→Only request response headers) |
|||
Ligne 30 : | Ligne 30 : | ||
See previous sample. | See previous sample. | ||
+ | |||
+ | == Request CORS headers == | ||
+ | |||
+ | curl -I -X OPTIONS -H "Origin: http://EXAMPLE.COM" -H 'Access-Control-Request-Method: GET' http://EXAMPLE.COM/SOMETHING 2>&1 | grep 'Access-Control-Allow-Origin' | ||
== Don't check SSL certificate == | == Don't check SSL certificate == |
Version actuelle datée du 25 septembre 2023 à 14:51
Sommaire
Introduction
This article lists a few ways to call curl, depending on your need.
Curl calls
Curl with verbose result
Curl option: -v (or --verbose).
Fake the DNS resolution
Use case:
- your website is behind a WAF and the FQDN resolves to it instead of the web server directly (the origin).
- your website is behind a reverse proxy, but you want to access the underlying web service with appropriate host header in your request.
curl --resolve <my.domain>:443:<IP> https://<my.domain>[/<my_uri>]
Add a request header
Curl option: -H (or --header).
Sample call:
curl -IL -H '<header name>:<header value>' https://<URL to curl>
Only request response headers
Curl option: -I
See previous sample.
Request CORS headers
curl -I -X OPTIONS -H "Origin: http://EXAMPLE.COM" -H 'Access-Control-Request-Method: GET' http://EXAMPLE.COM/SOMETHING 2>&1 | grep 'Access-Control-Allow-Origin'
Don't check SSL certificate
This option may be useful in some situations:
- SSL deep inspection on the path, recyphering being done with a self-signed certificate or a cert emitted by a CA not present in your local CA store.
- Test a WAF or reverse proxy configuration not totally ready regarding SSL configuration.
Curl option: -k (or --insecure).
Sample:
curl -k https://<IP> -I -v --header 'Host:<the real hostname your request for>'