This question already has an answer here:
I have many Web applications developed as Node.js based servers horizontally scaled with a Load Balancer in front of them. At the beginning all my Web applications exposed HTTP endpoints and the Load Balancer provided SSL termination for them. Now i'm thinking about the value of providing HTTPS endpoints instead of HTTP ones at the application server level. I think it is a good practice and my question is: Is this desired, recommended or required for you folks from a security standpoint?