This article highlights an important issue. But closing port 80 is sufficient to address this problem. Having considered this article, I think I would still des

This article highlights an important issue. But closing port 80 is sufficient to address this problem. Having considered this article, I think I would still design an API to use HTTPS only, with port 80 closed, with Basic Auth. There's no security problem then, and it's a whole lot easier to manage with existing tools. (eg, as rb2k_ points out, it makes it easy to use curl to debug things).