HTTPS vs HTTP
Why do production APIs require HTTPS, and what does TLS protect in transit?
Answers use simple, clear English.
Quick interview answer
HTTPS wraps HTTP in TLS, providing confidentiality (encryption), integrity (tamper detection), and server authentication (certificates). Without it, tokens, cookies, and PII can be sniffed or modified on the path. HSTS further prevents downgrade to HTTP.
Detailed answer
HTTPS wraps HTTP in TLS, providing confidentiality (encryption), integrity (tamper detection), and server authentication (certificates). Without it, tokens, cookies, and PII can be sniffed or modified on the path. HSTS further prevents downgrade to HTTP. TLS does not replace authz, input validation, or safe storage — it only secures the transport.
Full explanation
TLS does not replace authz, input validation, or safe storage — it only secures the transport.
Real example & use case
A banking mobile app refuses cleartext HTTP so session cookies cannot be stolen on public Wi-Fi.
Pros & cons
Pros: stops passive sniffing and many MITM cases with proper cert validation. Cons: misconfigured certs/pinning can break clients; TLS inspection appliances need careful trust stores.