Protecting Credentials with HTTP APIs

Redirecting HTTP requests to HTTPS is a common pattern for human- facing web resources. When done for authenticated HTTP API traffic, client credentials are exposed to the network. This document discusses the pitfalls of the redirect approach and makes deployment recommendations for authenticated HTTP APIs. It does not specify a protocol.