Web-debugging HTTPS PHP cURL requests with Fiddler

Recently I was faced with a task of implementing OAuth 1.0 authentication. The authentication must be done with JavaScript, and I had a working example implemented in PHP (as a console app).

I've done major part of the task, but on the last step - while trying to actually use OAuth token to receive data - I've got 'signature invalid' error. I've studied PHP script carefully and 'echo'-ed values of interest to console, but still no luck to figuring out what was wrong.

It would be very convenient to see all PHP traffic in Fiddler, I thought, and what you need for it is described below.

Assume that Fiddler is running as usual on localhost (127.0.0.1) on port 8888. First of all you need to tell cURL to use proxy.

$proxy = "127.0.0.1:8888";
$ch = curl_init();
curl_setopt($ch, CURLOPT_PROXY, $proxy);

for your convenience you can also tell cURL to print debug info:

curl_setopt($ch, CURLOPT_VERBOSE, 1);

This will run cURL thru Fiddler, but you will not see (by default) decoded HTTPS traffic, because Fiddler decode HTTPS only from browsers (again, by default), so you need to change it to '...from all processes' if you run from command line PHP script (or just cURL):



again, this will, most probably result in HTTPS certificate errors since cURL knows nothing about Fiddler certificate (and Windows certificates), so easiest way is to just tell cURL to ignore SSL certificate errors:

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);

That's all, now you should see PHP cURL traffic, both HTTP and HTTPS.

Big PHP rant

Oh my, this one deserves to be remembered.

I must admin, I use PHP in my little personal business site, but in a manner of advanced SSI, with little amount of logic. I've always wondered, why even so, I'm uncomfortable with PHP. Why even very simple scripts usually ended up me being in documentation, with finally "oh, that's how it is done". But I never imagined things are so bad there.

PHP language requres major cleanup. Remove all duplicate syntax. Remove php.ini with all to defaults, most of options should not be configurable at all! Create a stable platform that is consistent to every system and installation. Go with unicode as default. This will break all I know. So be it. Call it PHP 6, it will be new, but still known to many language.

But instead PHP group is doing almost exact opposite.