Too many requests from plugin

[luzat]

The plugin currently executes $api->isAuthenticated() very often. One case is in the backend in Widget::register, which is called on just about every request. It contains this line:

if (!\is_admin() || $api->isAuthenticated()) {

This leads to requesting recipient lists on each call. This alone often adds 50-100+ ms for each page load in the backend. I don't think authentication needs to be checked in most cases, but mainly when explicitly asking for it or changing information; maybe using a cron job for checking settings, too. A working patch for the case above seems to be to replace the line above with:

if (!\is_admin() || $api->isConfigured()) {

I don't see any negative consequences coming from that. One could consider caching isAuthenticated in WordPress transients, too, and remove those once settings are changed.

Another serious problem that I encountered, but which may be system specific, is, that the request is happening using cURL and often takes 3-6 seconds (!). This occurs because WordPress at one point uses curl_setopt($handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);. This leads to a very slow connection (maybe related to some outdated SSL/TLS configuration on client or server?). I was able to fix it using:

add_action('http_api_curl', static function ($handle, $args, $url) {
  if (preg_match('#^https://apiv\\d+\\.emailsys\\.net/#', $url) !== false) {
    curl_setopt($handle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
  }
}, 10, 3);

CURL_HTTP_VERSION_NONE works equally well and is probably more backwards compatible for old cURL versions. This may be a candidate for inclusion, too. Load times are down to a few 100 ms for a somewhat bloated backend compared to 4-7 seconds before.

[luzat]

I was able to reproduce the very slow requests that WordPress is doing using this proof of concept:

<?php
$user = '...';
$password = '...';
$url = 'https://apiv3.emailsys.net/v1/recipientlists';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_USERPWD, $user . ':' . $password);

// Removing either of the following lines helps.
curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Connection: close']);

$response = curl_exec($ch);
curl_close($ch);

It seems that with HTTP/1.1 the connection to the API hangs for ~5 seconds when Connection: close is sent. Not sure if this is a cURL or API bug. The hang can also be reproduced on the command line:

curl --http1.1 -H 'Connection: close' --url 'https://apiv3.emailsys.net/v1/recipientlists' --user 'user:password'

Maybe cURL waits for the connection to close when it detects that Connection: close is included and the server doesn't? For HTTP/2, this header is ignored.