For the MITM Part, I can think of: - Send HSTS header in your code, instead of relying on the server). - Drop the connection if it is not secure. This breaks a

For the MITM Part, I can think of: - Send HSTS header in your code, instead of relying on the server). - Drop the connection if it is not secure. This breaks a reverse-proxy setup though.