I have a GET API that is called by a JS snippet to offload some computation from the browser. There is no reason that any actual user would directly call the API (and would be a violation of our ToS if they did).

Is there a significant risk if we call this API as a http request rather than https? It should reduce our response times, however we're not sure if this represents a vulnerability to either us or our users.

CodePudding user response：

If you make XMLHttpRequest or fetch() requests to your HTTP API from HTTPS pages you will get mixed content errors

CodePudding user response：

Yes. You risk MITM attacks or Man-in-the-middle. Someone impersonating your server and spying on your client's request and event potentially changing them.