Download a password-protected file safely with PHP cURL

HTTP Basic authentication is common on private exports and staging sites. It is not the same as signing into a form: this example only works when the remote server supports Basic authentication and you have permission to download the file.

Keep the credentials and output private

Run this as a CLI script with PHP 8.3+ and cURL 7.85+ installed. Supply EXPORT_USERNAME and EXPORT_PASSWORD through your private runtime configuration, not literals committed to source or pasted into a shell command. Replace the fixed URL and output path with your own authorised locations.

<?php
declare(strict_types=1);

$username = getenv('EXPORT_USERNAME');
$password = getenv('EXPORT_PASSWORD');
if (!is_string($username) || $username === ''
    || !is_string($password) || $password === '') {
    throw new RuntimeException('Download credentials are not configured.');
}

$body = '';
$limit = 2 * 1024 * 1024;
$request = curl_init('https://exports.example.com/report.csv');
curl_setopt_array($request, [
    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
    CURLOPT_USERPWD => $username . ':' . $password,
    CURLOPT_PROTOCOLS_STR => 'https',
    CURLOPT_FOLLOWLOCATION => false,
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_SSL_VERIFYHOST => 2,
    CURLOPT_CONNECTTIMEOUT => 5,
    CURLOPT_TIMEOUT => 20,
    CURLOPT_WRITEFUNCTION => static function ($handle, string $chunk) use (&$body, $limit): int {
        if (strlen($body) + strlen($chunk) > $limit) {
            return 0;
        }
        $body .= $chunk;
        return strlen($chunk);
    },
]);

if (curl_exec($request) === false
    || curl_getinfo($request, CURLINFO_RESPONSE_CODE) !== 200) {
    throw new RuntimeException('Download failed; no output file was created.');
}

$oldMask = umask(0077);
$output = fopen('/absolute/private/export.csv', 'xb');
umask($oldMask);
if ($output === false) {
    throw new RuntimeException('Could not create a new private output file.');
}
try {
    if (fwrite($output, $body) !== strlen($body)) {
        throw new RuntimeException('Output is incomplete; do not use this file.');
    }
} finally {
    fclose($output);
}

The destination directory must already exist, be controlled by you and sit outside the web root. Exclusive xb creation refuses an existing file. A disk-write failure can leave an incomplete new file: inspect it before retrying, rather than treating its existence as success.

No redirects are followed, so credentials are not carried into an unexpected redirect chain. Keep the hostname fixed; do not make it a visitor-supplied URL. Check the expected content format too before consuming an export. Never disable certificate checks to “fix” a failed download.

References: PHP cURL options and exclusive file creation.