An http:// URL sends the request and response in cleartext, so anyone positioned on the network, on shared Wi-Fi, at an ISP, or between servers, can read it. If that request carries a login, a token, or any user data, it is exposed in transit. Use https:// for every request that touches anything sensitive.
Why it's a problem
Over plain HTTP, a request body with a password or an Authorization header with a token travels unencrypted. Passive interception is enough to capture it, and an active attacker can also alter the response. HTTPS encrypts the whole exchange and verifies you are talking to the real server, which is why it is the baseline for anything beyond fully public, non-sensitive content.
The pattern
await fetch("http://api.example.com/login", {
method: "POST",
body: JSON.stringify({ email, password }),
});The fix
await fetch("https://api.example.com/login", {
method: "POST",
body: JSON.stringify({ email, password }),
});Why AI tools write this
An http URL often comes from a local development example or older documentation, and it works against a local or test server. The cleartext exposure only matters once the same code talks to a real endpoint over a real network, so it survives into production unnoticed.
The quick fix
- Use https:// for every request that carries credentials, tokens, or user data.
- Redirect all site traffic to HTTPS and set a Strict-Transport-Security header.
- Never disable certificate verification to make an https call work; fix the certificate instead.