How to have Angular uses HTTP instead of HTTPS?

Question

I use the standard Angular http module to sent post requests to an on-prem virtual machine. It doesn't work because Angular keeps sending HTTPS requests instead of HTTP requests.

Sample of the code I use for a POST:

myFunction(request: MyType): any {
   const uri = "http://myVirtualMachine/myApi/myService";
   const headers = { 'content-type': 'application/json'};
   return this.http.post<any>(uri, request, {headers});
}

This works if I the POST is sent to localhost. For any other URI, HTTP is always replaced with HTTPS.

Any clue why and how to fix this?

Some notes:

• Angular 12.
• No interceptor, but if I add an interceptor, the request received by it contains HTTP, not HTTPS.
• Same issue in Edge and Chrome, in private mode or not, and even after having cleared all the caches I can think of.
• Domain security policy doesn't seems to be the issue here (chrome://net-internals/#hsts).

Answer 1

The culprit was this line in index.html:

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

I'm not sure how it get there, maybe when I installed msal.js for a test.