cli curl succeeds; php-libcurl invocation fails - php

Question

On Mac OS 10.9.1 with PHP 5.4.17 and curl 7.30.0, this curl request runs fine at the command line:
curl -u test:test http://localhost/protected/
But this PHP script using the curl library fails:
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://localhost/protected/');
curl_setopt($ch, CURLOPT_HTTPAUTH, 'CURLAUTH_BASIC');
curl_setopt($ch, CURLOPT_USERPWD, 'test:test');
curl_setopt($ch, CURLOPT_VERBOSE, TRUE);
echo curl_exec($ch);
curl_close($ch);
The output is:
$ php -e ./test.php
* Adding handle: conn: 0x7fe1b303de00
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7fe1b303de00) send_pipe: 1, recv_pipe: 0
* About to connect() to localhost port 80 (#0)
* Trying ::1...
* Connected to localhost (::1) port 80 (#0)
> GET /protected/ HTTP/1.1
Host: localhost
Accept: */*
< HTTP/1.1 401 Authorization Required
< Date: Sat, 25 Jan 2014 03:12:40 GMT
* Server Apache/2.2.24 (Unix) DAV/2 PHP/5.4.17 mod_ssl/2.2.24 OpenSSL/0.9.8y is not blacklisted
< Server: Apache/2.2.24 (Unix) DAV/2 PHP/5.4.17 mod_ssl/2.2.24 OpenSSL/0.9.8y
< WWW-Authenticate: Basic realm="Restricted Files"
< Content-Length: 401
< Content-Type: text/html; charset=iso-8859-1
<
[...]
Note that the "Authorization: Basic ..." line is missing from the request header. It works fine if I manually set a request header like this:
curl_setopt($ch, CURLOPT_HTTPHEADER, array(base64_encode('test:test')));
An older system running Mac OS 10.7.5 with PHP 5.4.11 and curl 7.21.4 correctly sends the Authorization header. I tried many different combinations of PHP (5.4.11, 5.4.17, 5.4.24, 5.5.8) and curl (7.30.0, 7.30.4), but on Mac OS 10.9.1, they all failed to send the Authorization header unless I set it manually. Why?

Answer 1

This is wrong:
curl_setopt($ch, CURLOPT_HTTPAUTH, 'CURLAUTH_BASIC');
^-- ^--
with the quotes, you're trying to set a string as the option. But CURL uses define()'d constants, which are NOT quoted.
Try
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
so you're using the actual CURL constant, not some random string that happens to LOOK like a constant.