This repository was archived by the owner on Mar 24, 2026. It is now read-only.
This repository was archived by the owner on Mar 24, 2026. It is now read-only.
Add option to forbid plain http requests (where ssl-redirect is unsafe) #11391
Description
I host an API, a webapp (and much more).
I want HTTP requests to the webapp to be redirected to HTTPS -> I use ssl-redirect.
I want HTTP requests to the API to return a 4XX "http_unsupported: This endpoint is only accessible over HTTPS."
Reason:
If an API consumer misconfigures his client to use plain HTTP, he won't know about it but all his secret tokens will be sent plaintext.
See hackernews API Shouldn't Redirect HTTP to HTTPS.
Most APIs (that don't redirect to HTTPS) return a 403, npm returns a 426 with no Upgrade header.