Remove cURL dependency

[reFX-Mike]

I'm using this indirectly through the sendgrid/sendgrid-php classes and on Windows, the cURL implementation doesn't access the certificates directly but rather needs an external file, whose location needs to be defined in the php.ini file.

Without that the sendgrid call silently fails (no exception, no warning etc.) and the HTTP return code is "0" with an empty body.

This is unacceptable. I fail to understand why curl is even needed at all. Creating an HTTP stream context and filling out the same information is rather trivial and works on all platforms without creating a dependency on cURL and the certificate file.

What's the rationale here?

[thinkingserious]

Hello @reFX-Mike,

We made the certificate change some time ago based on security recommendations internally and from our PHP community, initiated from this issue. However, the behavior of silent failure is not acceptable. We do have a PR that was just merged to address that issue, but it is yet to be released. I don't have a hard date on the next release, but we are definitely working towards a more predictable and frequent release schedule.

With regards to using cURL for the HTTP requests, this is the first I've heard of seeking an alternative. I'm open to new and better options, would you mind opening a new issue (or rename this one) to propose changing the cURL dependency so that we may open it up for discussion with our community? It will be useful to note the pros/cons to get the discussion started. Thank you!

With Best Regards,

Elmer

[reFX-Mike]

I would like to propose removing the cURL dependency and switch to a standard stream.

Here is some example code that I use to call the Google closure compiler. This builds a POST request and sends it to the server:

static function compileJS_online (String &$js) : string
{
	$params =	[
					'js_code' => $js,
					'compilation_level' => "SIMPLE_OPTIMIZATIONS",
					'output_format' => "text",
					'output_info' => "compiled_code",
				];

	$postdata = http_build_query ($params);

	$context = stream_context_create([
		'http' =>	[
						'method' => 'POST',
						'header' => 'Content-type: application/x-www-form-urlencoded',
						'content' => $postdata,
					],

		'ssl' => [
			'verify_peer' => false,
			'verify_peer_name' => false,
			'crypto_method' =>	STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT |
								STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
		],

	]);

	$result = file_get_contents ("https://closure-compiler.appspot.com/compile", false, $context);

	return $result;
}

The pros are that you don't need cURL and remove the certificate problem entirely, as the operating system (or PHP?) will do all this for you. Get requests are even easier, as they don't require any post data etc. at all. It would be a simple "file_get_contents ($url)".

I can't see any cons, unless there is some weird edge case I can't think of that is handled by cURL but can't be achieved with standard streams in PHP.