Everything (including links to external sites) should be on HTTPS. Browsers will error if you try to load JS assets from HTTP on a HTTPS site.
Don't use HTTP for API even if you could. Usually servers will return status 301 (client-side redirect) directed to the same URL but using HTTPS to any HTTP request.
Don't mix hostnames - do coolstore.com/api instead - that frees you from cross-origin security issues.
Don't use HTTP for API even if you could. Usually servers will return status 301 (client-side redirect) directed to the same URL but using HTTPS to any HTTP request.
Don't mix hostnames - do coolstore.com/api instead - that frees you from cross-origin security issues.