{"record":{"id":"7a3aeb9105d28a08","repo":"ducaale/xh","slug":"using-a-combination-of-x-request-and-l-location-which-may","errorCode":null,"errorMessage":"Using a combination of -X/--request and -L/--location which may cause unintended side effects.","messagePattern":"Using a combination of -X/--request and -L/--location which may cause unintended side effects\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/to_curl.rs","lineNumber":131,"sourceCode":"        // Already the default\n        (args.all, \"--all\"),\n        // No (straightforward?) equivalent\n        (args.history_print.is_some(), \"-P/--history-print\"),\n        // Might be possible to emulate with --cookie-jar but tricky\n        (args.session.is_some(), \"--session\"),\n        // Already the default (usually, depends on compile time options)\n        // Unclear if you can even change this at runtime\n        (args.native_tls, \"--native-tls\"),\n    ];\n\n    for (present, flag) in ignored {\n        if present {\n            cmd.warn(format!(\"Ignored {flag}\"));\n        }\n    }\n\n    if args.follow && !matches!(args.method, Some(Method::GET) | None) {\n        cmd.warn(\"Using a combination of -X/--request and -L/--location which may cause unintended side effects.\");\n    }\n\n    // Silently ignored:\n    // - .ignore_stdin: assumed by default\n    //   (to send stdin, --data-binary @- -H 'Content-Type: application/octet-stream')\n    // - .curl and .curl_long: you are here\n\n    // Output options\n    if args.verbose > 0 {\n        // Far from an exact match, but it does print the request headers\n        cmd.opt(\"-v\", \"--verbose\");\n    }\n    if args.quiet > 0 {\n        // Also not an exact match but it suppresses error messages which\n        // is sorta like suppressing warnings\n        cmd.opt(\"-s\", \"--silent\");\n    }\n    if args.debug {","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/ducaale/xh/blob/2404aceecc08b0b2d100fedc96f57745cd5904dc/src/to_curl.rs#L113-L149","documentation":"When -L/--location (follow redirects) is combined with an explicit -X/--request method that is not GET, curl may replay the custom method against redirect targets, potentially causing unintended side effects (e.g. re-POSTing to a redirected host). xh's translate() warns about this when generating the curl command, mirroring curl's own documented caveat.","triggerScenarios":"Calling translate() with args.follow == true and args.method set to something other than GET (e.g. POST/PUT/DELETE) while --curl/--curl-long output is requested.","commonSituations":"Following a 301/302 redirect after a POST login or payment call; APIs behind CDNs that redirect; scripts that blindly add -L to every curl command while also using -X POST.","solutions":["Remove -X/--request and let the method follow the redirect semantics (curl switches to GET for 301/302)","Drop -L/--location if redirects should not be followed for this request","Handle redirects manually (inspect the 3xx response and re-issue deliberately)","If the target API requires method preservation across redirects, configure curl's POST301/POST302 options explicitly in the generated command"],"exampleFix":"# before\nxh --curl -L -X POST example.org/login\n\n# after (let redirect semantics choose the method)\nxh --curl -L example.org/login\n# or keep POST but do not follow redirects\nxh --curl -X POST example.org/login","handlingStrategy":"validation","validationCode":"# Reject -L with a non-GET -X before running\ncase \"$method\" in\n  GET|\"\") : ;;\n  *) if [ \"$follow\" = \"1\" ]; then echo \"warning: -L with -X $method may replay $method on redirects\"; fi ;;\nesac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid -X with -L unless you understand redirect method semantics","For POST-then-redirect flows, let the server's 301/302 downgrade to GET naturally","Inspect redirect chains with --verbose before enabling -L in production scripts","Never blind-add -L to all curl commands in wrapper scripts"],"tags":["cli","curl","redirects","http-method","side-effects"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"2404aceecc08b0b2d100fedc96f57745cd5904dc","analyzedAt":"2026-09-13T19:13:33.814Z","contentChangedAt":"2026-09-13T19:13:33.814Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}