107
Your API Shouldn't Redirect HTTP to HTTPS
(jviide.iki.fi)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 29 May 2024
107 points (96.5% liked)
Programming
17314 readers
77 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 2 years ago
MODERATORS
It's interesting that the author and most others went with 403, when 426 seems to be the most appropriate.
Neither are perfect matches, since 403 is about authentication and 426 is for Upgrade semantics (i.e. the upgrade is over the same transport protocol, not switching from http to https). npm isn't sending an Upgrade header, which is required, but I think if it sent
Upgrade: TLS/1.0, HTTP/1.1then that would be claiming they supported TLS on port 80 (STARTTLS style) - possible but unconventional.