Cdtjkyj

I've been trying to make this work for a while now, and I just can't see why it's not working. It's just a simple script that's supposed to return either 200 (if it works) or 400 (if it doesn't). The trouble seems to come when I use variables to substitute values in Curl, example of a working curl:

curl --max-time 10 --write-out '%{http_code}' --silent --output '/dev/null' 

--insecure -X GET https://url -H 

**'authorization: bearer iUhYMrTBdx1GG97Bd99YqrbPojInugjTTnqT8TiRjqgZrZYynljfKpgfao'** 

--header 'content-type: application/json' --header 

"requestid: '999993122349238343493843958345'"

This works as expected and returns 200. When I replace the authorization bearer section in the following way I get a 400:

curl --max-time 10 --write-out '%{http_code}' --silent --output '/dev/null' 

--insecure -X GET https://url -H "authorization: bearer $TOKEN" --header 

'content-type: application/json' --header 

"requestid: '999993122349238343493843958345'"

I tried literally everything. Using the variable as "${TOKEN}", doing "'authorization: bearer $TOKEN'", even something similar to "'"'"'$TOKEN'"'"'". I don't know what else to try. When I remove the silent curl option I see the following error:

 400ODY></HTML>ror 400. The request is badly formed.</p>rset=us-ascii"></HEAD>trict.dtd">

I'm lost to why it works with plain text and not variables. Any ideas?

Edit:
Added verbose for both:

> GET /REDACTED-URL HTTP/1.1

> Host: hostname:44301

> User-Agent: curl/7.50.3

> Accept: */*

> authorization: bearer eyJ0eXA700JKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImF1bkM2QV9MbHFVZGNYV3Z6UzVGOURQUEFTSSIsImtpZCI6ImF1bkM2QV9MbHFVZGNYV3Z6UzVGOURQUEFTSSJ9.eyJpc3MiOiJodHRwczovL0dQLUlEUzo0NDMwMS9HUC5JRFMiLCJhdWQiOiJodHRwczovL0dQLUlEUzo0NDMwMS9HUC5JRFMvcmVzb3VyY2VzIiwiZXhwIjoxNTUyNDI5MTA1LCJuYmYiOjE1NTI0MjU1MDUsImNsaWVudF9pZCI6Ik1FUkNBRE9MSUJSRUlWUiIsImNsaWVudF9NYXJjYSI6IjEiLCJjbGllbnRfVXN1YUNvZGkiOiJEQk8iLCJjbGllbnRfVmFsaWRhRXN0YWRvQ3VlbnRhIjoiMCIsImNsaWVudF9FbnRpZGFkIjoiMzAiLCJzY29wZSI6IlByZXBhZ2FBcGkifQ.kkCGp3EJ7VkvR75Zt0MV5VRmNVf-jP5dcb7GaZF6nI5KGNUxfx_linht3nUUX4Hw55ZKhfkiUhYMrTBdx1GG97Bd99YqrbPojInugjTTnqT8TiRjqgZrZYynljfKpgfaofoBnK0EWgqsQxcxPNre2PkvxWV-x6AzPl_uVWml1Wo2bjAi37kVklYmjkbBIWe8EcyF90MMR28xcipIo2ULj5HgOizhvokPg1qDEiYetTU2MYJ1fFRVgJ5v7KF0mpUk7zBl9dvFeGT3MPfTN9EED4biqE-zRaC0r8DK7lr1PScfVHqs09sI89PXTN9Nm2lOT6c43CsUy-YhylhjJr6AfIARcFv1o0-gy0nKnWxSBYnt8NgK7rZCfpjFDUfmaYL5IXqirob98L0cWfvnV3iL6R73dNciayRDy6PqZG0sHWhKkggBIOhRqh-7VsY99qCqG76Beih-UqWPcWO_H8-4zvYDslsXMj8ff1Nk76h9pxuy-qAkRapNVAbBojf41JFVVaONqgPCH9Jszq7cpFbX6vbVq18p6hOhDb4BhuTDkT6tB30RXQWaSPqRbRs2h7VYIcuxok6wbrBzGA32hBHiSVSQs0PdheJlVy1EcHy27MJuIj_Vs6bsiq0a4GY-scs4A-68fvzsERfsLLINDrS4C9zY1f6RwfEkDsWlQ1ouBIk

> content-type: application/json

> requestid: '999993245235232323523523523535'

>

< HTTP/1.1 200 OK

< Content-Type: application/json; charset=utf-8

< Server: Microsoft-IIS/10.0

< requestid: '999993245235232323523523523535'

< CorrelationId: 3859af6f-4c8f-438c-bcfe-37ab6ecc0d6b

< RequestId: 9999af6f-4c8f-438c-bcfe-37ab6ecc0d6b

< X-Powered-By: ASP.NET

< Date: Tue, 12 Mar 2019 22:10:39 GMT

< Content-Length: 992

<

{ [992 bytes data]

This works ^

> GET /REDACTED-URL HTTP/1.1

> Host: hostname:44301

> User-Agent: curl/7.50.3

> Accept: */*

> authorization: bearer eyJ0eXA700JKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImF1bkM2QV9MbHFVZGNYV3Z6UzVGOURQUEFTSSIsImtpZCI6ImF1bkM2QV9MbHFVZGNYV3Z6UzVGOURQUEFTSSJ9.eyJpc3MiOiJodHRwczovL0dQLUlEUzo0NDMwMS9HUC5JRFMiLCJhdWQiOiJodHRwczovL0dQLUlEUzo0NDMwMS9HUC5JRFMvcmVzb3VyY2VzIiwiZXhwIjoxNTUyNDI5MTA1LCJuYmYiOjE1NTI0MjU1MDUsImNsaWVudF9pZCI6Ik1FUkNBRE9MSUJSRUlWUiIsImNsaWVudF9NYXJjYSI6IjEiLCJjbGllbnRfVXN1YUNvZGkiOiJEQk8iLCJjbGllbnRfVmFsaWRhRXN0YWRvQ3VlbnRhIjoiMCIsImNsaWVudF9FbnRpZGFkIjoiMzAiLCJzY29wZSI6IlByZXBhZ2FBcGkifQ.kkCGp3EJ7VkvR75Zt0MV5VRmNVf-jP5dcb7GaZF6nI5KGNUxfx_linht3nUUX4Hw55ZKhfkiUhYMrTBdx1GG97Bd99YqrbPojInugjTTnqT8TiRjqgZrZYynljfKpgfaofoBnK0EWgqsQxcxPNre2PkvxWV-x6AzPl_uVWml1Wo2bjAi37kVklYmjkbBIWe8EcyF90MMR28xcipIo2ULj5HgOizhvokPg1qDEiYetTU2MYJ1fFRVgJ5v7KF0mpUk7zBl9dvFeGT3MPfTN9EED4biqE-zRaC0r8DK7lr1PScfVHqs09sI89PXTN9Nm2lOT6c43CsUy-YhylhjJr6AfIARcFv1o0-gy0nKnWxSBYnt8NgK7rZCfpjFDUfmaYL5IXqirob98L0cWfvnV3iL6R73dNciayRDy6PqZG0sHWhKkggBIOhRqh-7VsY99qCqG76Beih-UqWPcWO_H8-4zvYDslsXMj8ff1Nk76h9pxuy-qAkRapNVAbBojf41JFVVaONqgPCH9Jszq7cpFbX6vbVq18p6hOhDb4BhuTDkT6tB30RXQWaSPqRbRs2h7VYIcuxok6wbrBzGA32hBHiSVSQs0PdheJlVy1EcHy27MJuIj_Vs6bsiq0a4GY-scs4A-68fvzsERfsLLINDrS4C9zY1f6RwfEkDsWlQ1ouBIk

> content-type: application/json

> requestid: '99999324523523534395600'

>

< HTTP/1.1 400 Bad Request

< Content-Type: text/html; charset=us-ascii

< Server: Microsoft-HTTPAPI/2.0

< Date: Tue, 12 Mar 2019 22:11:42 GMT

< Connection: close

< Content-Length: 311

<

{ [311 bytes data]

This doesn't. Same exact headers.

Assuming you set TOKEN as environment variable with export TOKEN=foo you should use ${TOKEN} in your header string.

curl --max-time 10 --write-out '%{http_code}' --silent --output '/dev/null' 

--insecure -X GET https://url -H "authorization: bearer ${TOKEN}" --header 

'content-type: application/json' --header 

"requestid: '999993122349238343493843958345'"

Using the --verbose option instead of --silent will print the following header information (excerpt):

> GET / HTTP/2

> Host: url

> User-Agent: curl/7.58.0

> Accept: */*

> authorization: bearer foo

> content-type: application/json

> requestid: '999993122349238343493843958345'

Alternatively -H "authorization: bearer "$TOKEN should work too.

It is also very important to use double quotes, because single quotes will not be parsed.