title: Curl authorization
body: <p>I have spring security with https settings.</p>
  
  <p>I'm seeing an unexpected behavior when trying to run curl GET on a URL in a secure way.</p>
  
  <p>When curl first sends a request to the server, it does it with no authorization data (why? I specifically added it). Then, the server reply with Authentication Error (401). 
  The client then re-transmits the request, this time with authorization data, and the server replies properly with the required data.</p>
  
  <p>Any idea why this happens?</p>
  
  <p>Curl command:</p>
  
  <blockquote>
    <p>curl -v --insecure --anyauth --user username:password -H "Accept: application/json" -H "Content-Type: application/json" -X GET localhost:8443/myresource</p>
  </blockquote>
  
  <p><strong>Request 1:</strong></p>
  
  <pre><code>&gt; GET /myresource HTTP/1.1
  &gt; User-Agent: curl/7.21.3 (x86_64-redhat-linux-gnu) libcurl/7.21.3 NSS/3.13.1.0 zlib/1.2.5 libidn/1.19 libssh2/1.2.7
  &gt; Host: localhost:8443
  &gt; Accept: application/json
  &gt; Content-Type: application/json
  </code></pre>
  
  <p><strong>Response 1:</strong></p>
  
  <pre><code>&lt; HTTP/1.1 401 Unauthorized
  &lt; Server: Apache-Coyote/1.1
  &lt; Set-Cookie: JSESSIONID=B56A7F49E715795B5D1158DB192710AA; Path=/myresource ; Secure; HttpOnly
  &lt; WWW-Authenticate: Digest realm="Protected", qop="auth", nonce="MTM0Njg2MjYwMjY0ODozNDk5ZDkxNTYxNjMxMDJmNDA4MWQ1NTBmZjk5OGQ5Nw=="
  &lt; Content-Type: text/html;charset=utf-8
  &lt; Content-Length: 1119
  &lt; Date: Wed, 05 Sep 2012 16:29:52 GMT
  </code></pre>
  
  <p><strong>Request 2:</strong></p>
  
  <pre><code>&gt; GET /myresource HTTP/1.1
  &gt; Authorization: Digest username="username", realm="Protected", nonce="MTM0Njg2MjYwMjY0ODozNDk5ZDkxNTYxNjMxMDJmNDA4MWQ1NTBmZjk5OGQ5Nw==", uri="/myresource", cnonce="ODczNjg0", nc=00000001, qop="auth", response="58faded9ae5f639ba0056fb86edca71f"
  &gt; User-Agent: curl/7.21.3 (x86_64-redhat-linux-gnu) libcurl/7.21.3 NSS/3.13.1.0 zlib/1.2.5 libidn/1.19 libssh2/1.2.7
  &gt; Host: localhost:8443
  &gt; Accept: application/json
  &gt; Content-Type: application/json
  </code></pre>
  
  <p><strong>Response 2:</strong></p>
  
  <pre><code>&lt; HTTP/1.1 200 OK
  &lt; Server: Apache-Coyote/1.1
  &lt; Set-Cookie: JSESSIONID=37F375C5663C4A049D95D49C7C1CF0FD; Path=/myresource ; Secure; HttpOnly
  &lt; Content-Type: application/json
  &lt; Transfer-Encoding: chunked
  &lt; Date: Wed, 05 Sep 2012 16:29:52 GMT
  </code></pre>