Authentication

Doing transfers with libcurl usually allows the application to do it withoutproviding any credentials at all. You could perhaps call itanonymously.

For FTP transfers, libcurl then uses a default user and password as theconvention tells us, while with some other protocols like SFTP and SCP thetransfer is most likely to simply fail. Authentication is simply mandatory forsome transfers.

Authentication for libcurl means credentials (user + password) and in somecases an additional method: letting the application select what authenticationmethod to use. Each protocol typically have their own sets.

Depending on the authentication method and if the transmission is perhaps notusing an authenticated security layer (such as TLS, QUIC or SSH) there is arisk that sensitive information leaks over the network. The easiest way toavoid this risk is to never use authentication with unauthenticated protocols.

For some protocols or methods, authentication is done per connection, forothers it is done per transfer. libcurl keeps track of that and makes surethat connections are reused correctly. Meaning that sometimes it cannot reuseconnections for transfers done using different credentials but sometimes itcan.

Username

Set the username withCURLOPT_USERNAME, as a plain null terminated C string.

The older option calledCURLOPT_USERPWD is better avoided, for the simplereason that it wants username and password in the same string, colonseparated, which easily cause problems if either the name or the passwordcontain a colon. Which can be tricky to guarantee never will happen.

Password

Set the password to use withCURLOPT_PASSWORD, as a plain null terminated Cstring.

Method

The method selection depends on the protocol. For HTTP specifics, see theHTTP Authentication section.

.netrc

Unix systems have for a long time offered a way for users to store their username and password for remote FTP servers. ftp clients have supported this fordecades and this way allowed users to quickly login to known servers withoutmanually having to reenter the credentials each time. The.netrc file istypically stored in a user's home directory.

libcurl supports getting credentials from the.netrc file if you ask it toit, with theCURLOPT_NETRC option.

This option has three different settings, withCURL_NETRC_IGNORED being thedefault:

Setting it toCURL_NETRC_OPTIONAL means that the use of the.netrc file isoptional, and user information provided in the URL is to be preferred. Thefile is scanned for the host and username to find the password.

CURL_NETRC_REQUIRED instead means that the use of the.netrc file isrequired, and any credential information present in the URL is ignored.