security - curl 总是返回两个 header

Question

我尝试在 Windows 和 Mac OS X 中使用curl，它们总是产生相同的结果。我正在发起针对领域的请求，并且我正在使用 --digest进行身份验证的标志:

curl <options> --digest --user admin <endpoint> -v -v --raw

我的所有调用都会产生两个 header :

* Adding handle: conn: 0x7f908c80ba00
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7f908c80ba00) send_pipe: 1, recv_pipe: 0
* About to connect() to localhost port 8002 (#0)
*   Trying ::1...
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8002 (#0)
* Server auth using Digest with user 'admin'
> PUT /endpoint HTTP/1.1
> User-Agent: curl/7.30.0
> Host: localhost:8002
> Accept: */*
> Content-type: application/xml
> Content-Length: 0
> 
< HTTP/1.1 401 Unauthorized
< WWW-Authenticate: Digest realm="public", qop="auth", nonce="e54fba22d0eca67e26155cf243dcf4ca", opaque="370985129eb9e9d5"
< Content-type: application/xml
* Server <X> is not blacklisted
< Server: <X>
< Content-Length: 173
< Connection: Keep-Alive
< Keep-Alive: timeout=5
< 
* Ignoring the response-body
* Connection #0 to host localhost left intact
* Issue another request to this URL: 'http://localhost:8002/endpoint'
* Found bundle for host localhost: 0x7f908b6095c0
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (127.0.0.1) port 8002 (#0)
* Adding handle: conn: 0x7f908c80ba00
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7f908c80ba00) send_pipe: 1, recv_pipe: 0
* Server auth using Digest with user 'admin'
> PUT /endpoint HTTP/1.1
> Authorization: Digest username="admin", realm="public", nonce="e54fba22d0eca67e26155cf243dcf4ca", uri="/endpoint", cnonce="ICAgICAgICAgICAgICAgICAgICAgIDEzOTc5NzM3MzY=", nc=00000001, qop=auth, response="47da275c9b69e8541ed335a040d4d10d", opaque="370985129eb9e9d5"
> User-Agent: curl/7.30.0
> Host: localhost:8002
> Accept: */*
> Content-type: application/xml
> Content-Length: 118
> 
* upload completely sent off: 118 out of 118 bytes
< HTTP/1.1 204 No Content
* Server <X> is not blacklisted
< Server: <X>
< Content-Length: 0
< Connection: Keep-Alive
< Keep-Alive: timeout=5
< 
* Connection #0 to host localhost left intact

为什么我总是收到 401 header ？我希望看到--anyauth标志但不带有 --digest .

Answer 1

您可以看到curl获取的所有 header 。

使用 --digest curl 必须首先获得 401 以获得随机数等，以便能够执行第二个请求来获取真实数据。

使用 --anyauth，curl 甚至不假设存在身份验证，因此它会首先通过执行普通请求(很像浏览器所做的那样)来“探测”页面，然后根据 401 响应来“探测”页面会行动的所以，是的，如果您执行 --anyauth 并且如果 curl 认为摘要是服务器表示支持该资源的最合适的身份验证方法，那么将会向服务器发出 3 个请求。