curl & wget for HTTP Debugging

curl -v for HTTP debugging, custom headers, authentication, TLS inspection, and REST API calls.

Overview

Overview curl is the Swiss Army knife for HTTP debugging and API testing. It supports nearly every HTTP feature and provides detailed output of the full request/response cycle.

curl -v (verbose mode): Shows the entire conversation — TCP connection, TLS handshake details, request headers (lines starting with >), and response headers (lines starting with <). Lines starting with * are informational (connecting, TLS version, SSL certificate details, connection reuse).

Request construction flags: - -X METHOD: HTTP method (GET is default, POST/PUT/DELETE/PATCH/HEAD) - -H "Header: Value": add request header - -d "body": request body (implies POST if -X not given) - --data-raw "body": like -d but no @ file interpretation - --data-binary @file: send file contents as-is - -F "field=value": multipart/form-data - -u user:pass: HTTP Basic authentication - -H "Authorization: Bearer token": JWT/OAuth authentication

Response and output flags: - -o file: save response body to file - -O: save with server filename - -s: silent (no progress meter) - -S: show errors even with -s - -I or --head: HEAD request only - -L: follow redirects - -w "%{time_total} ": write-out format string for timing metrics

TLS debugging: - --cacert ca.pem: custom CA certificate - --cert client.pem: client certificate - -k/--insecure: skip certificate verification (debugging only — never in scripts) - --resolve host:port:IP: override DNS without changing /etc/hosts

wget vs curl: wget is optimized for downloading files (recursive site download with -r, resume with -c). curl is better for API debugging, supports more protocols, and provides more output detail.

Key concepts

curl -v request anatomy
* lines: informational (TLS, connection). > lines: request headers sent. < lines: response headers received. Response body follows. -v is the first flag to add when debugging.
-H custom headers
curl -H "Content-Type: application/json" -H "Authorization: Bearer token" URL. Multiple -H flags for multiple headers. -H "header;" removes a default header.
-X HTTP methods
-X POST, -X PUT, -X DELETE, -X PATCH. Combine with -d for body. -X HEAD (or -I) for HEAD requests. Without -X, GET is default unless -d is given (implies POST).
-k TLS skip (insecure)
-k skips TLS certificate verification. Use ONLY for debugging — never in scripts or production. For proper debugging, use --cacert to specify the correct CA.

When to use it

  • Testing API endpoints during development and debugging
  • Verifying HTTPS certificate and TLS configuration
  • Debugging authentication and authorization issues
  • Measuring endpoint response times

Interview questions

  • Use curl to debug a failing HTTPS API call. What flags do you use and what do you look for in the output?
  • How would you test a REST API endpoint that requires JWT authentication and a JSON body?

Sign up free to read the full topic

More Linux topics

Start free on Cariara · Coding problems · System design studio