Gateway RidgeISSUE #12 of 35

https · why tls is non-negotiable

Gateway GusVSTimeout Titan

Gateway Gus saysHTTPS (HTTP over TLS) encrypts every API request — non-negotiable for any real API.

Plain HTTP sends everything (tokens, data) in the clear, readable by anyone on the network. HTTPS wraps HTTP in TLS to encrypt the connection, authenticate the server, and detect tampering. Modern auth (bearer tokens, OAuth, clipboard, geolocation) requires a secure context. There is no acceptable reason to run a production API over plain HTTP.

Power-ups you unlock

HTTP = plaintext; HTTPS = encrypted (TLS)
Encrypts data, authenticates server, detects tampering
Many web APIs require a secure context
Never ship a production API on plain HTTP

Timeout Titan attacks — common mistakes

Sending tokens over http://
Mixed content (https page calling http API)
Assuming a private network makes HTTP safe

Boss battleList three things TLS provides beyond "encryption".

Example code

<!doctype html><html><head><meta charset="utf-8"></head>
<body style="background:#06040d;color:#e6e0ff;font-family:monospace;padding:20px"><pre>HTTP : token visible to anyone on the wire
HTTPS: encrypted + server-authenticated + tamper-evident</pre></body></html>

▶ Open the interactive comic issue

‹ Compression · Gzip · Brotli · Zstd Tls · Certificates · Sni ›