Question: For client-side web applications that run in your machine (that you download at first visit - Blazor WebAssembly to be specific):

* Do I need to enable SSL (HTTPS) for this application or web server that hosts this application as well, or is it not needed in the end?
* Does only having API connection encrypted be enough?

Yes, this is a cost-saving measure, since this is for my hobby project and I would like to keep running costs as minimal as possible. But since I still exchange data, that should not be seen by 3rd party, this application needs to be secure.

To enable HTTPS I would need a second static IP, which is 3$ a month (which is not much), but again, it is additional cost for me, that I would rather not have.

My current architecture would look like this:

[![System architecture](https://i.stack.imgur.com/yrTwE.png)](https://i.stack.imgur.com/yrTwE.png)

As can be seen from the image, I have 3 web applications - API, Public web (landing page) and "Portal" where I log in and can add and access data.

For the current use case, I am concerned about the left side of this diagram.

My question is regarding to `app.domain.com`. Would it be safe to have it be on HTTP, when after downloading all communication with server would be over HTTPS (to API)? This app also includes login logic for user authentication.

**As for my current web hosting** I have those options for SSL. If I try to import new SSL, it requires me to have additional Static IP

[![enter image description here](https://i.stack.imgur.com/c9Amw.png)](https://i.stack.imgur.com/c9Amw.png)

[![enter image description here](https://i.stack.imgur.com/R4YxJ.png)](https://i.stack.imgur.com/R4YxJ.png)

Answer: 
> 
> To enable HTTPS I would need second Static IP, which is 3$ a month (which is not much), but again, it is additional cost for me, that I would rather not have.
> 
> 
> 

You don't need a second static IP. [Server Name Indication (SNI)](https://www.cloudflare.com/learning/ssl/what-is-sni/) has been a thing for quite some years now, and all modern clients supports it, including all major browsers.
When in doubt, encrypt everything.

Now, ask yourself what are you protecting and what from. Since it is a hobby, well...

If you use the app.domain.com just for downloading the app, that may render a smaller attack surface, but still there is a risk. I agree with @schroeder in the risk of having a binary replaced with malware.

For some time now, Google Chrome browser has been marking every HTTP page as not secure so, this may be a problem for some users.