Conversation

Fascinating blog that reveals a worrying practice: https://jviide.iki.fi/http-redirects.
Many sites exposing a service with an HTTP API can be accessed on HTTP. Sure, the server will redirect to HTTPS, but the client has already sent credentials over the HTTP connection, basically sending password-equivalent data in clear text! Consequences are easy to guess. The blog lists dozens of servers doing that, some small, several quite big!