All API traffic served over HTTPS/TLS

HTTP transmits credentials, tokens, and user data in plaintext — any network intermediary can read or modify traffic. CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-311 (Missing Encryption of Sensitive Data) cover the structural failure. OWASP API Security Top 10 2023 API8 (Security Misconfiguration) and OWASP A02 2021 (Cryptographic Failures) classify unencrypted API transport as a first-order misconfiguration. Even internal-facing APIs that carry authentication tokens should use TLS — internal networks are not trusted networks. PCI DSS Requirement 4.2.1 and SOC 2 CC6.7 both require encryption of data in transit. HSTS prevents browsers from falling back to HTTP after the first HTTPS connection.

Enforce HTTPS at the infrastructure level first (load balancer / CDN), then add application-level redirect middleware as a defense-in-depth layer. Set HSTS with a minimum max-age of one year.

// src/middleware.ts (Next.js)
export function middleware(req: NextRequest) {
  // Redirect HTTP to HTTPS at app layer (CDN should handle this first)
  if (req.headers.get('x-forwarded-proto') === 'http') {
    return NextResponse.redirect(`https://${req.headers.get('host')}${req.nextUrl.pathname}`, 301)
  }

  const res = NextResponse.next()
  // HSTS — 1-year, include subdomains, preload
  res.headers.set(
    'Strict-Transport-Security',
    'max-age=31536000; includeSubDomains; preload'
  )
  return res
}

Vercel and most PaaS platforms enforce HTTPS at the edge — verify that no internal service-to-service calls use http:// URLs.