interagent/http-api-design — pull request #37 by rhoberman (2014-07-21 17:10:36+00:00)
Title: Responding for non-TLS requests

Do we consider it best practice to respond to non-TLS requests with a 403?

The other alternative that I am aware of is to redirect to a secured version of the URL. But I don't much like that approach since it makes it easy for a sloppily written client to continue doing bad things.

Could we add recommendation to the Require TLS block? Perhaps:

Enforce good client-behaviour by responding to insecure requests with a 403 status code. Redirects are discouraged since they allow client code to effectively ignore the issue, doubling up on server traffic and rendering TLS useless since sensitive data will already have been exposed by the first call.