The request must be dont with HTTPS.