Your API Shouldn't Redirect HTTP to HTTPS

This post argues that APIs should not redirect HTTP to HTTPS due to the downsides and potential security risks involved. It highlights the importance of a fail-fast approach for unencrypted API calls and suggests disabling the HTTP interface or returning clear error responses for unencrypted requests. The post also mentions popular APIs that either redirect or respond with plaintext, and suggests amending best practices to explicitly recommend against redirecting HTTP to HTTPS for APIs.