Instead of redirecting API calls from HTTP to HTTPS, make the failure visible. Unfortunately, many well-known API providers don't currently do so.
  • vithigar@lemmy.ca
    491·
    6 months ago

    This article isn’t about browsers or websites, and even acknowledges in the opening that it makes sense as a usability tradeoff in that context.

    • v9CYKjLeia10dZpz88iU
      194·
      6 months ago

      I clearly didn’t read it. It makes sense, if users aren’t visiting the API then it really doesn’t matter that it’s not redirected on insecure connections.

      • pinchcramp@lemmy.dbzer0.comEnglish
        111·
        6 months ago

        I clearly didn’t read it.

        I love the honesty. It’s really refreshing to see someone take accountability instead of becoming defensive.