curl command line POST password - forms

Question

I have the following curl command which works perfectly fine:
curl --silent --location -cookie "$COOKIE" --cookie-jar "$COOKIE" \
--form 'username=xxx' --form 'password=yyy' 'http://example.com'
It logs into site http://example.com posting a form with variable names username and password.
Problem is: I do not want to pass the password in clear.
I have also tried to save the password in a file called passwd in the working directory (chmod 600 passwd) and used the following curl command (this is why I used --form instead of --data, which would have been worked fine with the password in clear), however, it does not work:
curl --silent --location -cookie "$COOKIE" --cookie-jar "$COOKIE" \
--form 'username=xxx' --form 'password=<passwd' 'http://example.com'
Any suggestion about how to solve this?
Regards,
Stefano

Answer 1

Hans Z. answer to use environmental variable is correct in my opinion. Though I might just add that in bash you could use read command, which would prompt for password and not make it visible in history.
So the usage would look like this
$ read -s PASSWD # -s is there so the characters you type don't show up
$ curl --silent --location -cookie "$COOKIE" --cookie-jar "$COOKIE" \
--form 'username=xxx' --form "password=${PASSWD}" 'http://example.com'
UPDATE:
Another solution found in the comments is to use curl's --data-urlencode name#filename argument.
Quoting the manpage:
name#filename
This will make curl load data from the given file (including any newlines), URL-encode that data and pass it on in the POST.
And the final command looked like
$ curl --silent --location -cookie "$COOKIE" --cookie-jar "$COOKIE" \
--data 'username=xxx' --data-urlencode "password#passwd" 'http://example.com'

Answer 2

Set the password in an environment variable, e.g. export PASSWD=secret and use it in --form "password=${PASSWD}".

Answer 3

Passing secrets in command line is insecure as they are available in process list.
You should use the --data-urlencode name#filename approach
This will make curl load data from the given file
(including any newlines), URL-encode that data and
pass it on in the POST.
or -K, --config <file>
Specify a text file to read curl arguments from. The
command line arguments found in the text file will be used
as if they were provided on the command line.
See also this anwser