How to Follow Redirects in cURL: Step-by-Step Command Guide

Curl supports more than 25 protocols including HTTP, HTTPS, and FTP, but its redirect functionality isn't turned on automatically. Developers and system administrators often find this default setting frustrating when they work with websites that use redirects.

The default curl behavior won't follow redirects when servers send 3xx status codes (300-399). You can easily turn on this feature with the -L or --location option in your commands. Curl can follow up to 50 redirects in a row once enabled. This limit is much higher than what Google Chrome and Mozilla Firefox allow, as they stop at 20 redirects. These features make curl a very powerful tool to test and debug web applications.

This piece covers everything you need to know about following redirects with curl. You'll learn how to handle curl follow 301 and curl follow 302 responses. We'll also look at ways to limit redirect chains and fix common problems that you might face along the way.

Understanding Redirects and cURL Behavior

HTTP redirects are a core part of web architecture since the first HTTP specification (RFC 1945) in 1996. A redirect happens when servers tell clients to find requested resources at different locations instead of serving them directly. This process uses HTTP status codes in the 3xx range with a "Location" header that points to the new destination URL.

What is an HTTP redirect and how it works

The server responds with a 3xx status code and a Location header to the new URL when you request a moved resource. Your browser then makes a new request to this location automatically. Users don't notice this seamless process. Each redirect type serves a specific purpose:

• 301 (Moved Permanently): The resource has a new permanent location. All future requests should use the new URL
• 302 (Found): The resource moved temporarily. Keep using the original URL for future requests
• 303 (See Other): Works as with 302 but forces a GET method for the next request
• 307 (Temporary Redirect): Functions like 302 but keeps the original HTTP method
• 308 (Permanent Redirect): Marks a permanent move while preserving the HTTP method

Default behavior of cURL with 3xx status codes

Browsers follow redirects automatically, but cURL works differently. cURL will not follow redirects by default when it gets 3xx responses. It shows you the redirect response with the 3xx status code and Location header without making another request to the new URL. This approach is nowhere near what users expect from their browser experience.

Why cURL does not follow redirects by default

Security is the main reason cURL doesn't follow redirects automatically. This prevents unwanted redirects to potentially harmful sites. It also gives you better control over HTTP requests and lets you check redirect chains before moving forward.

cURL's philosophy is to "only do the basics unless told differently". This design choice helps users maintain full control over their request destinations. The tool becomes more predictable and safer in scripting environments where unexpected redirects might cause problems.

Using -L to Follow Redirects in cURL

cURL doesn't automatically follow redirects, but you can enable this feature with a single option. Here's how to make cURL follow HTTP redirects effectively.

Basic syntax: curl -L

The -L flag (equivalent to --location) makes cURL follow redirects. The syntax is straightforward:

curl -L https://example.com

This command tells cURL to automatically request the new URL specified in the Location header whenever a server sends a 3XX status code response. Developers find this option useful to get detailed information about server request processing.

You can see redirect chains and their headers by adding these flags:

‍curl -L -i https://example.com    # Shows final response headers and content
curl -L -v https://example.com    # Displays the complete redirect chain

How -L handles 301, 302, and 303 status codes

The -L option makes cURL handle most redirect types in a similar way. It follows the Location header for all 3XX redirect codes, though each has its own meaning:

• 301 redirects (Moved Permanently): cURL follows the new location without caching it for future requests
• 302 redirects (Found/Moved Temporarily): cURL follows the redirect but doesn't store it
• 303 redirects (See Other): cURL handles these like 302 redirects

cURL will follow up to 30 redirects by default to avoid infinite loops. You can change this limit with the --max-redirs option:

curl -L --max-redirs 10 https://example.com

curl follow 301 vs curl follow 302 behavior

The -L flag processes 301 and 302 status codes almost the same way, despite their different intentions (permanent versus temporary moves). The main difference lies in HTTP method handling.

HTTP specifications state that cURL converts POST requests to GET for the next request when it encounters 301, 302, or 303 redirects. This means your original POST data won't be included in the follow-up request.

You'll need these options to keep the POST method during redirects:

curl -L --post301 https://example.com   # Maintains POST after 301 redirects
curl -L --post302 https://example.com   # Maintains POST after 302 redirects
curl -L --post303 https://example.com   # Maintains POST after 303 redirects

‍These flags ensure your request method stays consistent throughout the redirect chain.

Advanced Redirect Handling Options

cURL provides specialized options beyond the simple -L flag that give you detailed control over redirect behavior. These advanced parameters help you handle security, debugging, and complex request scenarios better.

--max-redirs to limit redirect loops

The latest version 8.3.0 of cURL follows up to 30 redirects automatically. This limit stops infinite redirect loops from hanging your requests. You can change this setting with:

curl -L --max-redirs 10 https://example.com

You can set the value to -1 for unlimited redirects, though this can be risky.

--post301, --post302, --post303 to preserve POST method

Your non-GET requests automatically convert to GET after receiving 301, 302, or 303 redirects. You can keep your original POST method throughout the redirect chain with these options:

curl -L --post301 -d "data" https://example.com
curl -L --post302 -d "data" https://example.com
curl -L --post303 -d "data" https://example.com

‍


--location-trusted for cross-host authentication

cURL keeps credentials restricted to the original hostname. Your authentication won't carry over when redirects move to different hosts. The --location-trusted option sends your credentials to all redirect destinations:

curl -L --location-trusted -u username:password https://example.com

Be careful with this option since it might expose your credentials to servers you don't trust.

-v and -i flags for debugging redirect chains

You can troubleshoot redirect issues with these commands:

curl -v -L https://example.com   # Verbose output showing complete request/response cycle
curl -i -L https://example.com   # Includes response headers in output

‍
These flags show you each step in the redirect sequence and display all headers and status codes clearly.

Common Redirect Scenarios and Troubleshooting

URL redirects between different domains create unique challenges beyond simple cURL commands.

Redirects to different hostnames and authentication issues

Authentication problems often arise when moving between different hostnames because cURL restricts credential sharing by default. Your authentication headers or cookies won't automatically follow when a redirect points to another domain. The --location-trusted parameter addresses this by forwarding your credentials to all redirect destinations. This solution requires caution since it might expose sensitive information to unintended servers.

How to detect and fix broken redirect chains

Redirect chains happen when URLs send visitors through multiple redirects before reaching their final destination. Page load times slow down and crawl budget gets wasted with these chains. Several tools can help identify broken chains:

• Screaming Frog SEO Spider for bulk detection
• Browser extensions like Redirect Path to trace redirects immediately

The quickest way to fix these chains is to point the first redirect straight to the final destination URL. Your internal links should then be updated to remove the need for redirects completely.

Why cURL can't follow JavaScript or HTML meta redirects

cURL processes only HTTP-level redirects. Two common redirect methods remain beyond its capabilities:

1. HTML meta redirects: <meta http-equiv="refresh" content="0; url=http://example.com/">
2. JavaScript redirects: Code that executes in browsers to change location

These client-side redirects need HTML parsing or JavaScript execution features that cURL doesn't have.

Conclusion

cURL's default behavior doesn't automatically follow 3xx redirect responses. This design choice might seem frustrating at first, but it gives users complete control over their HTTP requests.

The -L or --location flag is the quickest way to enable redirect following in cURL. This simple parameter changes cURL from a request tool into a redirect-following powerhouse. It can handle up to 50 sequential redirects - nowhere near what most browsers support.

The system offers several advanced options to boost redirect handling capabilities. You can prevent infinite redirect loops with --max-redirs parameter. The --post301, --post302, and --post303 options preserve your original HTTP methods during redirects. --location-trusted becomes valuable especially when you have cross-domain authentication scenarios. However, you should use it carefully due to potential risks.

cURL's powerful features come with some limitations. It can't process JavaScript or HTML meta redirects because it lacks HTML parsing and JavaScript execution capabilities. You might need extra tools to test websites that heavily rely on client-side redirects.

This knowledge helps you work confidently with websites using redirects for testing, debugging, or automating interactions. You'll know exactly how to set up cURL whenever you encounter a 301, 302, or any other redirect response. cURL becomes an even more valuable addition to your web development and administration toolkit.

FAQs

How do I enable redirect following in cURL?

To enable redirect following in cURL, use the -L or --location flag in your command. For example: curl -L https://example.com. This will make cURL automatically follow any HTTP redirects it encounters.

What's the difference between cURL's handling of 301 and 302 redirects?

cURL treats 301 (permanent) and 302 (temporary) redirects similarly when the -L flag is used. The main difference is in HTTP method handling. By default, cURL converts POST requests to GET for both types of redirects. To maintain the POST method, use --post301 or --post302 flags.

How can I limit the number of redirects cURL follows?

You can use the --max-redirs option to limit the number of redirects cURL will follow. For instance, curl -L --max-redirs 10 https://example.com will follow up to 10 redirects before stopping. The default limit is 30 redirects.

Can cURL handle JavaScript or HTML meta redirects?

No, cURL cannot process JavaScript or HTML meta redirects. It only handles HTTP-level redirects (3xx status codes). This is because cURL lacks HTML parsing and JavaScript execution capabilities.

How do I troubleshoot redirect issues with cURL?

To debug redirect issues, use the -v (verbose) or -i (include headers) flags with cURL. For example, curl -v -L https://example.com will show the complete request/response cycle, including all steps in the redirect sequence, headers, and status codes.