---
title: "MPP challenge issued over unencrypted HTTP — x402 defect class mpp-challenge-over-http"
description: "MPP challenge issued over unencrypted HTTP (mpp-challenge-over-http), an x402 defect class: Payment challenges are issued only over TLS. Detectable by an unpaid probe. Servers MUST NOT issue Payment challenges over unencrypted HTTP; a credential sent in reply travels in the clear, and a client that honours the MUST refuses the door outright."
canonical: "https://scvd.store/defects/mpp-challenge-over-http"
url: "https://scvd.store/defects/mpp-challenge-over-http"
term_code: "mpp-challenge-over-http"
defined_in: "https://scvd.store/defects"
data: "https://scvd.store/defects.json"
vocabulary_version: "22"
license: "https://creativecommons.org/licenses/by/4.0/"
---

# MPP challenge issued over unencrypted HTTP

`mpp-challenge-over-http` — an x402 defect class.

**Asserts:** Payment challenges are issued only over TLS.

**Costs:** Servers MUST NOT issue Payment challenges over unencrypted HTTP; a credential sent in reply travels in the clear, and a client that honours the MUST refuses the door outright.

**Detectable:** unpaid — a free probe can see it

**Falsified by:** The same door serving its challenge over https at the stated moment.

**How an operator clears it:** Serve the door over https only and redirect or refuse plain http before the 402 is built; a challenge over http is a challenge no conforming client will answer.

**What a buyer does:** Never send a Payment credential over plain http, whatever the door asks: the credential travels in the clear. Refuse, and use the door's https address if it has one.

**Our signal:** `mpp-tls-only`

---

Vocabulary v22, CC BY 4.0. Every class: https://scvd.store/defects. Machine-readable, with falsifiers and cross-instrument mappings: https://scvd.store/defects.json.

A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.