An http:// URL sends the request and response in cleartext, so anyone positioned on the network, on shared Wi-Fi, at an ISP, or between servers, can read it. If that request carries a login, a token, or any user data, it is exposed in transit. Use https:// for every request that touches anything sensitive.
Why it's a problem
Over plain HTTP, a request body with a password or an Authorization header with a token travels unencrypted. Passive interception is enough to capture it, and an active attacker can also alter the response. HTTPS encrypts the whole exchange and verifies you are talking to the real server, which is why it is the baseline for anything beyond fully public, non-sensitive content.
The pattern
await fetch("http://api.example.com/login", {
method: "POST",
body: JSON.stringify({ email, password }),
});The fix
await fetch("https://api.example.com/login", {
method: "POST",
body: JSON.stringify({ email, password }),
});Why AI tools write this
An http URL often comes from a local development example or older documentation, and it works against a local or test server. The cleartext exposure only matters once the same code talks to a real endpoint over a real network, so it survives into production unnoticed.
The quick fix
- Use https:// for every request that carries credentials, tokens, or user data.
- Redirect all site traffic to HTTPS and set a Strict-Transport-Security header.
- Never disable certificate verification to make an https call work; fix the certificate instead.
Common questions
Can I force all traffic to HTTPS in Next.js?
Yes. Set a Strict-Transport-Security header via next.config.js headers, and configure your host to redirect HTTP to HTTPS. Both are needed because HSTS only works after the first successful HTTPS response.
Does the browser see the plain-text request before a redirect?
Yes. An HTTP-to-HTTPS redirect still exposes the initial request, including the URL and any query parameters, to anyone watching the network. Sensitive forms must be reached directly via HTTPS.
Is http:// over localhost safe for local development?
Yes. Over localhost the traffic never leaves your machine, so http is safe for development. Gate HTTPS enforcement on the environment variable so local development is not broken.