With regards to Paypal's recent security update I have started adding two additional options to my cURL code, those being:
curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($ch, CURLOPT_SSLVERSION, 6);
I set CURLOPT_HTTP_VERSION
since not setting it seems to default to "lets CURL decide which version to use" - whilst I don't want or like to hardcode the setting for future compatibility reasons, can cURL be trusted to always set HTTP 1.1
if support is available?
Secondly, I set CURLOPT_SSLVERSION
to 6
, which is CURL_SSLVERSION_TLSv1_2
because I have read that..
Some environments may be capable of TLS 1.2 but it is not in their list of defaults, so need the SSL version option to be set.
Now, an additional query is I notice at that PayPal link it only makes mention of endpoints, but how about when you're making cURL
requests to their other URL's like the common: https://www.paypal.com/cgi-bin/webscr
used for things such as IPN listeners? Does that still require TLS 1.2 and HTTP 1.1?
from PayPal's recent TLS 1.2 / HTTP 1.1 updates and when to use it
No comments:
Post a Comment