Home/ Questions/Q 6025157
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T04:15:39+00:00

I’m creating an API intended to be used by Javascript clients hosted on different

  • 0

I’m creating an API intended to be used by Javascript clients hosted on different domains via CORS requests.

My API can only be accessed via HTTPS.

I’d like to restrict access to only those Javascript clients that are also served from HTTPS domains.

Reading the CORS spec – http://www.w3.org/TR/cors/#user-agent-security – it appears that most user agents will automatically prevent HTTPS client to HTTP API requests.

Is it possible to require the reverse – i.e. prevent HTTP clients accessing my HTTPS API?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    What about checking the Referer header to see if it begins with “https”? You could also verify that the Referer matches the Origin domain as a sanity check.

    • 0