Can drupal_http_request be secure (https)?

Question

I'm using drupal_http_request to parse some user details between servers.

Is it possible to secure drupal_http_request using https or should I fall back to cURL?

If there's a better way, do tell.

Answer 1

Yes, it can.

case 'https':
  // ***************
  // Note: Only works when PHP is compiled with OpenSSL support.
  // ***************
  $port = isset($uri['port']) ? $uri['port'] : 443;
  $socket = 'ssl://' . $uri['host'] . ':' . $port;
  $options['headers']['Host'] = $uri['host'] . ($port != 443 ? ':' . $port : '');
  break;

Answer 2

Not sure if I am understanding you properly, but drupal_http_request() does handle https:// URLs. If you want to send a request to https://example.com, you can do it.

Answer 3

No,

drupal_http_request doesn't correctly verify certificates, which makes it impossible to tell if you connected to the right server.

See https://drupal.org/node/1081192 for details and a path forward. This also includes a workaround you can deploy with some work.