I know HTTP is insecure because the data transmitted is not encrypted.
I made a web application, however, that the frontend and backend are hosted on different servers. The backend itself is configured with HTTPS, but the frontend is not yet (so only HTTP). Every request I make to the backend is made using the HTTPS server.
So this got me thinking: If my "insecure" frontend only uses the sensitive data to make requests to an HTTPS server, doesn't it make my application secure? Because the sensitive data is not transmitted in anyway to the frontend HTTP server, it is merely a static webpage.
And on the other hand, if the situation was reversed: being HTTPS configured on my frontend (thus, it appears as a secure application on the user side, on the browser), but the API endpoints are HTTP. Doesn't it make the application insecure, even though it is an HTTPS website? Because sensitive data would be transmitted to eg http://myinsecureapi.doamin.com
.