<!-- What do you want to happen? -->
I host an API, a webapp (and much more).
I want HTTP requests to the _webapp_ to be redirected to HTTPS -> I use `ssl-redirect`.
I want HTTP requests to the _API_ to return a 4XX "`http_unsupported: This endpoint is only accessible over HTTPS.`"

Reason:
If an API consumer misconfigures his client to use plain HTTP, he won't know about it but all his secret tokens will be sent plaintext.

See hackernews [API Shouldn't Redirect HTTP to HTTPS](https://news.ycombinator.com/item?id=40504756).

Most APIs (that don't redirect to HTTPS) return a 403, npm returns a 426 with no `Upgrade` header.
<!-- Is there currently another issue associated with this? -->

<!-- Does it require a particular kubernetes version? -->

<!-- If this is actually about documentation, uncomment the following block -->

<!-- 
/kind documentation
/remove-kind feature
-->

Add option to forbid plain http requests (where ssl-redirect is unsafe)
This is a GitHub Issue
repo:ingress-nginx
owner:kubernetes
Title : Add option to forbid plain http requests (where ssl-redirect is unsafe)
Issue date:

--- start body ---
<!-- What do you want to happen? -->
I host an API, a webapp (and much more).
I want HTTP requests to the _webapp_ to be redirected to HTTPS -> I use `ssl-redirect`.
I want HTTP requests to the _API_ to return a 4XX "`http_unsupported: This endpoint is only accessible over HTTPS.`"

Reason:
If an API consumer misconfigures his client to use plain HTTP, he won't know about it but all his secret tokens will be sent plaintext.

See hackernews [API Shouldn't Redirect HTTP to HTTPS](https://news.ycombinator.com/item?id=40504756).

Most APIs (that don't redirect to HTTPS) return a 403, npm returns a 426 with no `Upgrade` header.
<!-- Is there currently another issue associated with this? -->

<!-- Does it require a particular kubernetes version? -->

<!-- If this is actually about documentation, uncomment the following block -->

<!-- 
/kind documentation
/remove-kind feature
-->

--- end body ---

The issue highlights a potential security vulnerability where sensitive information, such as secret tokens, could be transmitted over plain HTTP instead of HTTPS. This could lead to exposure of sensitive data if an API consumer misconfigures their client to use HTTP. The request for an option to return a 4XX error instead of redirecting to HTTPS indicates a need for better security practices in handling HTTP requests for APIs.