[t3h2mas]

You cannot remove the attack surface when the app/service is served via http

Remove? Probably not. There are many options for minimizing the attack surface with http.