Is it acceptable to run a website which only serves on HTTPS and not HTTP. Consider situations where plain domain names are typed in address bar. Usually websites redirect the user to the HTTPS version.
There is a good reason for wanting to only provide HTTPS. Consider this scenario:
- User is a developer using a REST API to talk to server.
- User forgets the "s" at the end of "http" when posting potentially sensitive information.
- POST goes on wire with its payload on a non-secure channel vulnerable to the usual eavesdropping.
- Only after the POST is complete, does the server send a redirection code to the secure site