Learn Wget - Authentication & Security Best Practices

#Introduction

In episode 13 you made sure the server you're talking to really is the server you intended — the other party's identity was verified. Now it's your side's turn: many servers won't send anything until you prove who you are. Episode 14 covers authentication in wget — and, just as importantly, how to store that proof of identity without leaking it. Security isn't about strong keys alone; it's about strong keys that are never left on the table.

#Don't Write Credentials on the Command Line

The simplest way to give credentials to wget is --user and --password:

# JANGAN: password terlihat oleh siapa pun di sekitar
wget --user=budi --password=rahasia123 https://example.com/data

The problem isn't the mechanism — it's the leaks. The command is recorded in shell history, visible in the process list (ps) while running, and sticks to terminal logs. Writing a password on the command line is like writing your PIN on your forehead and then delivering packages — one photo and your ATM card is useless.

#--ask-password: The Hidden Prompt

For manual sessions, let wget ask for the password. The --ask-password option makes wget show an interactive prompt with hidden input:

wget --user=budi --ask-password https://example.com/data

The characters you type don't appear on screen, don't enter shell history, and don't show up in the process list. This pattern is the right habit for shared machines — as simple as choosing a door with a lock over a door with no lock at all.

#.netrc: The Credential Home

For scripts and automation, wget provides a more permanent way: the .netrc file. It's a text file containing machine, login, and password pairs:

machine docs.example.com
    login budi
    password rahasia123

To be used, wget needs to be pointed at that file — it isn't enabled by default:

wget --netrc https://docs.example.com/private/data

--netrc reads ~/.netrc; --netrc-file=/path/file points to a specific credential file (for example in CI); --no-netrc asserts that .netrc is not used at all.

#The Correct Permissions

.netrc stores passwords in plain text, so it must be treated like a key:

chmod 600 ~/.netrc

Permission 600 means only the owner can read and write. A file readable by other users is a key placed at the front door — and many tools (including wget) refuse or downgrade files that are too open. Because the credentials live in a file rather than on the command line, they never leak through shell history.

#--auth-no-challenge and Basic Policy

One option that's often misunderstood: --auth-no-challenge. By default, wget waits for the server to challenge with a WWW-Authenticate header before sending Basic credentials. This option reverses that order — credentials are sent up front without waiting for the challenge:

wget --auth-no-challenge --user=budi --password=rahasia \
  https://api.example.com/data

The advantage: one round-trip faster, and useful for old servers that don't send challenges correctly. The downside: credentials are sent even to servers that don't ask for them. Use it only on servers you know well — it's the habit of knocking on a door while holding your ID card open: fine at your own home, risky in unfamiliar environments.

#Checklist: HTTPS Everywhere

Now we reach the most valuable part of this episode — habits that save you from unnecessary drama.

Always use HTTPS for anything touching credentials. Basic authentication in wget sends credentials base64-encoded, and base64 is merely encoding, not encryption — anyone on the network path can break it in seconds.

# JANGAN: kredensial terkirim hampir telanjang lewat HTTP
wget --user=budi --password=rahasia http://dl.contoh.local/data

HTTP without TLS makes --user/--password and the contents of .netrc travel in a form anyone in the middle can read. HTTPS isn't a suggestion — it's a requirement.

#Checklist: Checksum and Signature Verification

A successful download isn't necessarily a correct download. Files can be corrupted along the way, or deliberately replaced by someone else. That's why trusted sources publish checksums — mathematical fingerprints of files — which you should compare after downloading. This short script combines timestamping and checksum verification:

#!/usr/bin/env bash
set -euo pipefail
 
URL="https://example.com/app/app-1.2.3.tar.gz"
EXPECTED="9f2c1a7b4d8e0f3c5a6b7c8d9e0f1a2b3c4d5e6f"
FILE="${URL##*/}"
 
wget --timestamping "$URL"
echo "$EXPECTED  $FILE" | sha256sum -c --status || {
  echo "Checksum tidak cocok — batalkan!" >&2
  exit 1
}
echo "File valid: $FILE"

Once the file's checksum is verified, it finally stops. sha256sum -c compares the recomputed fingerprint against the published value; the script stops before using a suspicious file. For a higher level, verify digital signatures with GPG: gpg --verify file.sig file — a checksum proves the file wasn't changed, a signature proves who published it.

#Checklist: The Risk of Untrusted Sources

Every download is a decision: trusting the execution or use of a file to a particular source. Downloading a binary from an unofficial site is like inviting a stranger into your home without checking their ID. Three questions are always worth asking:

• Is the source official — the main site, an official mirror, or a CDN announced by the maintainers?
• Was the file downloaded over HTTPS with a valid certificate — not with --no-check-certificate?
• Was the published checksum or signature verified?

#Closing

Episode 14 closes the security loop on your side: keeping credentials off the command line, using --ask-password for a hidden prompt, storing credentials in .netrc with 600 permissions, understanding --auth-no-challenge, then running the security checklist — HTTPS everywhere, checksum and signature verification, and weighing the risk of untrusted sources.

The key thing to remember: credentials and the files you download are assets — treat them that way. A strong key without safe storage habits is just false confidence.

In episode 15, we shift from security to efficiency: timestamping and incremental optimization — how to make wget download only what changed, limit speed, and be a polite neighbor to servers. See you there!