Refuse plain HTTP on the API

How to do it

A redirect comes too late, because the token already crossed the network in clear text. Close port 80 for the API host, or answer every HTTP request with 403. Revoke any key that arrives over plain HTTP. Set up TLS itself as the website playbook's HTTPS rule describes.

Example

server {
  listen 80;
  server_name api.example.com;
  return 403;
}

How to check

curl -si http://api.example.com/orders fails to connect or answers 403. It never answers 301, 302, 307 or 308.