Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

laracoft's avatar

Strange Sanctum behavior when using cURL from CLI

Hi,

My following code works, i.e. I'm able to call the API to perform tasks:

    $token = 'sanctum|token|abcdefg';
    $response = Http::withToken($token)
        ->post('https://example.com/api/test', []);

What I can't figure out is, why curl from the CLI redirects me to /login

curl \
    --header "Authorization: Bearer sanctum|token|abcdefg" \
    https://example.com/api/test

...

> GET /api/test HTTP/1.1
> Host: example.com
> User-Agent: curl/7.61.1
> Accept: */*
> Authorization: Bearer sanctum|token|abcdefg
>
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 302 Found
< Date: Mon, 03 May 2021 06:50:11 GMT
< Server: Apache
< Vary: Authorization
< X-Powered-By: PHP/7.4.13
< Cache-Control: no-cache, private
< Location: https://example.com/login
< Strict-Transport-Security: max-age=31536000
< Access-Control-Allow-Origin: *
< Set-Cookie: XSRF-TOKEN=eyJpdiI6IkFqT1BHVitlaURLZ3dYOHVxVTR2amc9PSIsInZhbHVlIjoicVpJSU52RXVzbEpRNmF5OXdXbzBrS3MxWittbW1IaHU4WE9YVW1Cd0dYK3E2ZzBOVkhRWTJ5RlBZZXMvZU9uMmxnR2NUVlJEbkdwdjhIMXk3R2VwK1oxakFPYjNxZFY2OVlNTUlPR1V3UFp5WlhWa0lhVXdzN0luMnFTOU5nYXQiLCJtYWMiOiI3OTQyYWNmY2FiZDcxYThhNWE2MWQ4YjZkZTYxZWQzZTIyYmNhMDJjMmFlYmFhNGUwNDU5ZjRjY2RiNWNhNmU4In0%3D; expires=Mon, 03-May-2021 08:50:12 GMT; Max-Age=7200; path=/; samesite=lax
< Set-Cookie: ********_session=eyJpdiI6ImJXTHlENVpzOFBleDNnbkJnZHZPNUE9PSIsInZhbHVlIjoiM0MrbXlKWVluaEJwY3p0TTRRMHNUdHVHNDZ3NTVLRUlCZnAwQnBqeGwrZUgwUGFOSytYUUVtMEd0N2lveDh5SExZQ2ZRZDRRZk51ME1pdW0xejJWejI1bDdJQm9wTklMSnl1R08xU3lNNGhiWXh6WnpvOW9FWE8wMUNGMDlsRkgiLCJtYWMiOiJiMDY5MDI4ZTdiODBkYjM5MTFiMDIxMTRmZmM2M2VhOWZhMGUzMTJkMmI4YjYwMWRmM2NlOTE4N2IwYzI4MDc4In0%3D; expires=Mon, 03-May-2021 08:50:12 GMT; Max-Age=7200; path=/; httponly; samesite=lax
< Content-Length: 386
< Content-Type: text/html; charset=UTF-8
<
<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='https://example.com/login'" />

        <title>Redirecting to https://example.com/login</title>
    </head>
    <body>
        Redirecting to <a href="https://example.com/login">https://example.com/login</a>.
    </body>

Any idea? Thank you.

0 likes
2 replies
laracoft's avatar

@mvd

No, cURL does not process the HTML portion for redirect. It is the HTTP/1.1 302 Found that causes it.

However, /api/test is supposed to output TEST, which it does when I call it using Http::.

Why does cURL get a redirect instead of TEST?

Please or to participate in this conversation.