The situation is a bit more complex than the title suggests (but not much).
I'm working on a REST API that will have a few open / publicly available resources and a few with authentication. (The latter is currently BasicAuth, but may in the future become something else.)
Obviously, I'd like to have HTTPS for the authenticated resources. But should I also use it for the open ones?
I can't decide between:
- Using HTTP means less overhead and less fiddling with certificates for both server and client
- Using HTTPS means a more homogenous setup, plus it hides the content from being read during transport