In a previous post, I have explained how to use cURL to test harness REST based Web services. One thing I did not described was how to add Transport Layer Security (TLS) in your tests. In other words, how to successfully test REST Web services over HTTPS?
The cURL manual describes a certain number of options that can be used. One of the most convenient option is -k or --insecure. It allows curl to perform "insecure" SSL connections and transfers. All SSL connections are attempted to be made secure by using the CA certificate bundle installed by default. So if you SSL connection does not require client side authentication it is a very quick way to test your web service over SSL:
curl -k https://www.acme.com/api/version
Another useful option can be used if in conjunction to SSL, you need to compress your payload via GZIP for example to optimize the transfer of large messages. In this case, you will use the option -H or --header that will help you specify custom headers to your request:
curl -H "Accept-Encoding: gzip,deflate" -k https://www.acme.com/api/users/list
Notice in that case that the -k or --insecure option is always placed just in front of URL.
Of course, other headers such as the one described previously can be combined:
The cURL manual describes a certain number of options that can be used. One of the most convenient option is -k or --insecure. It allows curl to perform "insecure" SSL connections and transfers. All SSL connections are attempted to be made secure by using the CA certificate bundle installed by default. So if you SSL connection does not require client side authentication it is a very quick way to test your web service over SSL:
curl -k https://www.acme.com/api/version
Another useful option can be used if in conjunction to SSL, you need to compress your payload via GZIP for example to optimize the transfer of large messages. In this case, you will use the option -H or --header that will help you specify custom headers to your request:
curl -H "Accept-Encoding: gzip,deflate" -k https://www.acme.com/api/users/list
Notice in that case that the -k or --insecure option is always placed just in front of URL.
Of course, other headers such as the one described previously can be combined:
curl -c ./cookies.txt --data-binary @login_password.json -H "Content-Type: application/json" -H "Accept-Encoding: gzip,deflate" -k https://www.acme.com/api/users/token
