HTTPS-only for Cloudflare APIs: shutting the door on cleartext traffic

What this post added

This post details the technical implementation of closing HTTP ports (80 and others) for api.cloudflare.com to enforce HTTPS-only API traffic. It explains the security risks of cleartext HTTP requests, especially for API tokens, and the limitations of redirection and HSTS for API clients. The solution involves preemptively refusing connections at the transport layer by disabling HTTP ports, preventing handshake and data exchange before sensitive information is transmitted. It also touches on the challenges of global scale, the need to support legacy clients, and the use of Tubular with BSD Sockets API for managing IP addresses and ports.