You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
An API is not a website
For websites, it is recommended to redirect HTTP to HTTPS
but for an API is wrong,
API-only endpoints should disable HTTP altogether and only support encrypted connections. When that is not possible, API endpoints should fail requests made over unencrypted HTTP connections instead of redirecting them.
set $block 0;
if ($scheme = http) { set $block 1; }
if ($request_uri ~ ^/\.well-known/acme-challenge/) { set $block 0; }
if ($block = 1) { return 444; }
add a second note to enable gzip for json responses in the same nginx config file gzip on; gzip_types application/json application/problem+json;
Activity
arhimede commentedon Oct 13, 2026
add a small note in this page , in a section like "best practice"
https://docs.dotkernel.org/api-documentation/v7/reference/production-readiness/
why should be disable
and code for nginx
gzip on; gzip_types application/json application/problem+json;