对于需要 SSL/TLS 的请求，发送的正确 HTTP 响应是什么
我正在设计一个 RESTful API，其中一些调用通过 HTTP 公开，而一些调用需要 API 密钥并通过 HTTPS 加密。我正在考虑如果将 HTTP 请求发送到私有资源之一，应该发送什么响应代码。到目前为止，唯一让我惊讶的是412 - Precondition Failed，但标准表明前提条件是由请求者而不是服务器强加的。
对于这种情况是否有适当的响应代码，或者我只需要屈服并执行400？
I'm designing an RESTful API where some calls are public over HTTP, and some require an API key and encryption over HTTPS. I'm deliberating on what response code should be sent if an HTTP request is sent to one of the private resources. So far the only one that jumps out at me is 412 - Precondition Failed, but the standard indicates that the precondition is imposed by the requester not the server.
Is there an appropriate response code for this condition or do I just need to give in and do 400?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
返回带有原因短语“需要 HTTPS”的 403 似乎是一个实用的选择，也是我所使用的。
请参阅 https://en.wikipedia.org/wiki/HTTP_403
重定向 REST Api 不是好主意，尤其是当您可能不知道如何或什么消耗您的服务时。
Returning a 403 with reason phrase "HTTPS Required" seems like a practical option and what I use.
see https://en.wikipedia.org/wiki/HTTP_403
Redirecting a REST Api is not a good idea especially as you may have no idea as to how or what is consuming your service.
返回的相应错误代码类似于 403.4 - 需要 SSL。
尽管 HTTP 1.1 的 RFC 中没有明确记录，此行为确实符合此处概述的要求：
添加您自己的子代码（如 SSL 示例）在某些情况下可能会有所帮助，但由于此子代码对第三方没有意义，因此我建议不要这样做。
因此，您的最终错误消息将类似于“403 - 私有资源”。请注意，即使在缺少 API 密钥的情况下，也不应使用“401 - 未经授权”，除非您的 API 密钥实际上可以在 WWW-Authenticate 标头字段中传输。
The appropriate error code to return would be similar to 403.4 - SSL required.
Although not explicitly documented in the RFC for HTTP 1.1, this behavior does match the requirements outlined there:
Adding your own subcode (as with the SSL example) might be helpful in some cases, but since this subcode would not be meaningful to third parties, I would recommend against it.
So, your final error message would be something like "403 - Private Resource". Note that, even in the case of a missing API key, "401 - Unauthorized" should not be used, unless your API key can actually be transmitted in a WWW-Authenticate header field.
只需发送重定向到相应的 https: URI。
更新
这是一个错误的答案 - 请参阅下面的评论
Just send a redirect to the corresponding https: URI.
UPDATE
The is a wrong answer - see comments below
我不能说这是否被 HTTP 客户端广泛接受，但严格来说 RFC，服务器应该响应：
来源：
https://www.rfc-editor.org/rfc/rfc2817#section- 4.2
I cannot say if this is broadly accepted by HTTP clients, but speaking strictly RFC, the server should respond with:
Source:
https://www.rfc-editor.org/rfc/rfc2817#section-4.2
强制 HTTP 客户端使用 HTTPS 的最安全方法是 HTTP 严格传输安全。
以前常见的建议是断开连接，但这种做法已删除以支持 HSTS（OWASP 网站）。
The most secure way to force HTTP client to use HTTPS is HTTP Strict Transport Security.
Previously a common suggestion was to drop the connection, but this practice has been removed in favor of HSTS (OWASP website).