REST API works in browser and via AJAX but fails via cURL

Question

I'm using a WordPress REST API to get contents of a page. The URL I'm using is:

https://sitename.org/wp-json/wp/v2/pages/4322

When I open that URL in browser, I'm getting back valid response.

But when I try to use that same URL via cURL, I'm getting:

couldn't connect to host

The code I'm using is this:

$page_id = 4322;
$wp_api_url = "https://sitename.org/wp-json/wp/v2/pages/".$page_id;             
$ch = curl_init();          
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_URL, $wp_api_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);         
curl_setopt($ch, CURLOPT_TIMEOUT, 10);                      
$response = curl_exec($ch); 

if (FALSE === $response)
{       
    echo curl_error($ch); // <---- failing here
}
else
{
    echo '<pre>';
    print_r(json_decode($response, true));
    echo '</pre>';
}
curl_close($ch);

Which begs the question:

1. Why does it work via a browser then?
2. Do I have to use some kind of authentication while calling an API via cURL?

Answer 1

It seem I am very late for this question, but I post my experience to here anyway, and hope it can help anyone with similar experience, since it is so hard to google an answer for this kind of rare situation.

I have a very similar problem. I tested thru Browser and AJAX, they are OK, but I got connection timed out when I send the request with PHP cURL.

But my situation is a bit different. I have 2 servers, server A is the host of the API, and server B is the requesting server.

Server B is my production server that, people have been using it without any problem, until one day, I got connection timed out error from Server A.

Then, I found out that, Server A firewall blacklisted Server B, because Server B tried to perform SQL injection. (That is why browser and AJAX didn't blocked by Server A, because you are sending the request from your PC, not thru the server) So, I solved my problem by whitelisting Server B in Server A.

But the story is not end yet. The reason why server A blacklist server B was because one of my user enter a big chunk of paragraph via the API that contain the word "selected" (it is selected, not select alone) and "from", for some reason the server A marked it as SQL injection. It sound weird, but I guess the server's ModSecurity is too sensitive.

Answer 2

You can use the following code and should work, if not we should see the server configuration to see why. Also, we can check the curl_error for hints.

$curl = curl_init();
$page_id = 4322;
$wp_api_url = "https://sitename.org/wp-json/wp/v2/pages/".$page_id;     
curl_setopt_array($curl, array(
  CURLOPT_URL => $wp_api_url,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
));

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);