title: Forcing cURL to get a password from the environment
body: <p>This <a href="https://stackoverflow.com/questions/2594880/using-curl-with-a-username-and-password">question about using cURL with a username and password</a> has suboptimal answers for me:</p>
  
  <ol>
  <li><code>curl -u "user:pw" https://example.com</code> puts the pw in the process list</li>
  <li><code>curl "https://user:pw@example.com"</code> puts the pw in the process list</li>
  <li><code>curl -u "user:$(cat ~/.passwd)" https://example.com</code> puts the pw in the process list</li>
  <li><code>curl -u user https://example.com</code> prompts for the pw</li>
  <li><code>curl --netrc-file ~/.netrc https://example.com</code> requires a file</li>
  </ol>
  
  <p>#4 is secure, but I might run this command hundreds of times a day, so it's tedious.  #5 is close to secure, but that file could be read by somebody with root access.</p>
  
  <p>The <a href="http://curl.haxx.se/docs/manpage.html#-u" rel="noreferrer">cURL man page</a> says (note the bold text):</p>
  
  <blockquote>
    <h2><code>-u/--user &lt;user:password&gt;</code></h2>
    
    <p>Specify the user name and password to use for server authentication.
    Overrides <code>-n/--netrc</code> and <code>--netrc-optional</code>.</p>
    
    <p>If  you  just give the user name (without entering a colon) curl will
    prompt for a password.</p>
    
    <p>If you use an SSPI-enabled curl binary and do  NTLM  authentication, <strong>you
    can force curl to pick up the user name and password from your environment</strong>
    by simply specifying a single  colon  with this option: <code>-u :</code>.</p>
  </blockquote>
  
  <p>I've tried setting <code>$USER</code> and <code>$PASSWORD</code> (and <a href="http://manpages.ubuntu.com/manpages/utopic/man3/CURLOPT_PASSWORD.3.html" rel="noreferrer"><code>$CURLOPT_PASSWORD</code></a> and others) in the environment, but cURL doesn't pick up either of them when invoked as <code>curl -u : https://example.com</code> (nor does it work without the <code>-u :</code>).</p>
  
  <p>I'm not doing NTLM, so this doesn't work.  Unless I'm missing something.</p>
  
  <p>&nbsp;</p>
  
  <p><strong>Is there a way to pass credentials to <code>curl</code> solely through the environment?</strong></p>
  
  <p>&nbsp;</p>
  
  <p><sub>(Workaround moved to an answer)</sub></p>