I have an API that I want to be accessible only by HTTPS. I know I can use URL-rewrite to force a redirect, but don't want to install additional modules. I was wondering whether only providing an HTTPS binding would be a secure solution as opposed to offering(in a way that HTTP connectionsconnection would not be allowed).
Is it possible to somehow trick the server into accepting HTTP request with this kind of setup?