4 ms·

Can't they deny all requests from non HTTPS pages then?

• vstm 14y ago
  No, I think there is no way to detect if the HTTP-request to the server which makes the API call is made via HTTPS or not. Except if their libraries detect that on your side and block the API call there, but of course that can be easily circumvented. They can only enforce that HTTPS requests are made to their API.
  • mikeash 14y ago
    Detecting it on your side and blocking the call there would still be really useful. Most people who use HTTP instead of HTTPS probably do so by accident or out of ignorance, and detecting that during development and telling them to fix it would be useful.