Bash脚本中POST请求自动转为GET问题求助

Hey there! Let's break down that confusing "switching from POST to GET" message you're seeing, and fix up your script to work reliably.

Why You're Seeing That Message #

First off, that warning comes directly from curl's -L (follow redirects) behavior. By default, if you send a POST request that gets redirected with a 301 or 302 status code, curl will automatically switch to a GET request for the redirected URL. That's what the warning is telling you—and this switch is almost certainly breaking your login flow, since most login endpoints expect a POST with credentials.

Looking at your script snippet, I spot two immediate red flags contributing to this:

• You're using -L globally but aren't forcing curl to keep using POST during redirects.
• There's a syntax error: your rm out.out command isn't followed by a semicolon or newline, so it's getting mashed together with the subsequent curl command, causing unexpected behavior.

Step-by-Step Fixes #

Let's walk through fixing your script, step by step:

1. Force POST on Redirects #

Add curl's --post301 and --post302 flags whenever you're sending a POST request (like when submitting login credentials). These tell curl to stick with POST instead of switching to GET when it hits a 301/302 redirect.

2. Fix Script Syntax #

Make sure each command in your loop is properly separated with a semicolon or newline. Your current rm out.out curl ... line is invalid—curl will try to interpret out.out as a command argument, which is not what you want.

3. Explicitly Separate Request Steps #

Split your script into clear, distinct steps to avoid mixing GET and POST flows accidentally:

• First, fetch the initial session cookies and login URL.
• Then, use that URL to send a POST request with your credentials, preserving POST through redirects.

4. Add Debugging (Optional but Helpful) #

Throw in the -v (verbose) flag to curl commands when testing—this will show you exactly what redirects are happening, which URL is triggering the method switch, and whether your cookies are being sent correctly.

Modified Script Example #

Here's how your script might look with these fixes applied:

for i in $(cat accounts.txt); do
    # Clean up previous output
    rm out.out

    # Step 1: Grab initial cookies and extract the login endpoint URL
    curl -L -b cookies.txt -c cookies.txt https://website.com | grep -Eo "(http|https)://cookies.website.com/idp[a-zA-Z0-9./?=_-]*" > login_url.tmp
    LOGIN_URL=$(cat login_url.tmp)
    rm login_url.tmp

    # Step 2: Submit login credentials, force POST on redirects
    # Assuming accounts.txt is in "username:password" format
    USER=$(echo "$i" | cut -d':' -f1)
    PASS=$(echo "$i" | cut -d':' -f2)

    curl -L --post301 --post302 -b cookies.txt -c cookies.txt \
         -X POST -d "username=$USER&password=$PASS" \
         "$LOGIN_URL" > out.out
done

Additional Notes #

• If the login form uses CSRF tokens, you'll need to extract that from the initial page too (add another grep/sed step to pull the token value, then include it in your POST data).
• Avoid using $(cat accounts.txt) if your usernames/passwords contain spaces or special characters—use a while read loop instead for safer parsing:

  while IFS=':' read -r user pass; do
      # Your login logic here
  done < accounts.txt
  

内容的提问来源于stack exchange，提问作者rootmonkey