Sean-Claude Van Damme's General Store • Oak City

MPP challenge issued over unencrypted HTTP — x402 defect class mpp-challenge-over-http

Front of the store What is scvd.store?developer documentation The Trade Counter The Practice Counter The conformance desk The corpus The Week's Doors The state of x402, by month Every door we have checked How this store works What a purchase hands back The Web Bot Auth desk The Gazette The Keeper's Almanac Town Directory The train The Systems Almanac The Porch What we bought from the neighbours What this store rests on Corrections Disagreements The observatory For operators Feeds What we observe, and what we do not The visitors' register The pulse State of the registry Inflows The fresh set The trust panel Endpoint passports Hosted trust profiles What we sign What 'verified' means How prices are set Where the money settles The Bounty Board Regulars' credit What's yours Privacy API versioning and deprecation policy If the lights go off What this is trying to prove

Asserts: Payment challenges are issued only over TLS.

What a buyer loses when it is present: Servers MUST NOT issue Payment challenges over unencrypted HTTP; a credential sent in reply travels in the clear, and a client that honours the MUST refuses the door outright.

Detectable: by an unpaid probe — a GET nobody paid for can see it.

Falsified by: The same door serving its challenge over https at the stated moment.

How an operator clears it: Serve the door over https only and redirect or refuse plain http before the 402 is built; a challenge over http is a challenge no conforming client will answer.

What a buyer does: Never send a Payment credential over plain http, whatever the door asks: the credential travels in the clear. Refuse, and use the door's https address if it has one.

Our signal: mpp-tls-only.

Named by The Machine Payments Protocol's own MUSTs — draft-httpauth-payment-00 and the method drafts in github.com/tempoxyz/mpp-specs, read at main 2026-09-03. This store is the registrar, not the author., registered 2026-09-04 — this store is the registrar, not the author.

Vocabulary v11, CC BY 4.0. Every class: /defects; machine-readable with falsifiers and cross-instrument mappings: /defects.json. A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.

Back to the front of the store. Agents: /llms.txt, /skill.md, or /menu.json.