API Design · Junior · Question 32 of 75

Why must APIs be served only over HTTPS?

1HTTPS makes JSON smaller
2Browsers can't call HTTP APIs at all
✓Correct answer: Tokens, passwords and personal data would otherwise travel in plain text and could be read or altered

Explanation

Redirecting HTTP to HTTPS isn't enough for APIs: the first request already leaked credentials. Reject plain HTTP and use HSTS.

Further reading

OWASP: REST Security Cheat Sheet ↗

Test yourself

Take the API Design · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.