Cheat sheet · No. VIII
curl.
curl speaks dozens of protocols, but for debugging HTTP you live in a handful of flags: -v to watch the conversation, -w to measure it, --resolve to fake DNS.
The reference
VERBOSITY
-v- Verbose: headers + handshake
-vv- More: TLS internals (with -tls1_3)
-i- Include response headers in output
-I- HEAD request only
-s- Silent (no progress)
--trace-ascii out.txt- Full byte-level trace
METHODS & BODY
-X POST- Explicit method
-d 'k=v'- POST form data
-d @file.json- POST file contents
-H "X-Y: Z"- Add header
--json '{"k":"v"}'- POST JSON (sets Content-Type)
-F field=@file- multipart upload
PROTOCOL CONTROL
--http2- Force HTTP/2
--http3- Force HTTP/3 (QUIC)
--tls1_3- Force TLS 1.3
-k- Skip cert verification (test only!)
--resolve host:port:ip- DNS override
--cacert ca.pem- Custom root
OUTPUT
-o file- Save to file
-O- Save with remote name
-w '%{http_code}\n'- After-request format string
-w '%{time_total}s\n'- Wall-clock time
REPLAY
--cookie-jar f- Save cookies
--cookie f- Load cookies
-L- Follow redirects
--max-time 5- Total timeout (s)
--retry 3- Retry on failure
DEBUG GOLD
curl -sw '\n%{http_code} %{time_total}s\n' <url>- Status + time, no body noise
curl -v --resolve x.com:443:1.2.3.4 https://x.com- Test specific origin behind LB
curl -k -v https://localhost:8443- Self-signed dev server
Field notes
A one-line latency probe
-w '%{http_code} %{time_total}s\n' turns curl into a measurement tool — just the status and timing, no body noise.
Fake DNS
--resolve host:port:ip tests one specific origin behind a load balancer without touching /etc/hosts.
Follow redirects
-L follows 3xx hops; without it curl prints the redirect and stops. Add --max-redirs to avoid loops.
TLS off is dev-only
-k skips certificate verification — fine for a self-signed dev box, never in a script that touches production.