Skip to content

disable HTTP to HTTPS redirect #181

Closed

Description

@arhimede

An API is not a website
For websites, it is recommended to redirect HTTP to HTTPS
but for an API is wrong,

API-only endpoints should disable HTTP altogether and only support encrypted connections. When that is not possible, API endpoints should fail requests made over unencrypted HTTP connections instead of redirecting them.

https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html#use-tls-for-all-pages

So we need to update documentation about that

Activity

  1. self-assigned this
    on Sep 10, 2026
  2. transferred this issue fromdotkernel/apion Oct 13, 2026
  3. arhimede commented on Oct 13, 2026

    @arhimede
    MemberAuthor

    add a small note in this page , in a section like "best practice"

    https://docs.dotkernel.org/api-documentation/v7/reference/production-readiness/
    why should be disable
    and code for nginx

    set $block 0;
    if ($scheme = http) { set $block 1; }
    if ($request_uri ~ ^/\.well-known/acme-challenge/) { set $block 0; }
    if ($block = 1) { return 444; }
    
    1. add a second note to enable gzip for json responses in the same nginx config file gzip on; gzip_types application/json application/problem+json;
  4. linked a pull request that will close this issueupdated production readiness page #183on Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions