HTTPS website+API, confusion about best practices?
Let's say we have a site
www.coolstore.com
that accesses
api.coolstore.com
What is the best practice and possible attack vectors when not sticking to them?
It seems that www.coolstore.com should be under https://www.coolstore.com. What about assets? Let's say we force a redirect to https:// on the site itself, but not on assets. e.g. you copy the request and change it to http you can access some javascript files. Would that be a problem?
How about API ? Is it neccesary that also api.coolstore.com requires https, even though it's only used by the website? Should it have http:// completely turned off?
Is there some manual of best practices with deploying react site + api ?
What is the best practice and possible attack vectors when not sticking to them?
It seems that www.coolstore.com should be under https://www.coolstore.com. What about assets? Let's say we force a redirect to https:// on the site itself, but not on assets. e.g. you copy the request and change it to http you can access some javascript files. Would that be a problem?
How about API ? Is it neccesary that also api.coolstore.com requires https, even though it's only used by the website? Should it have http:// completely turned off?
Is there some manual of best practices with deploying react site + api ?