I'm completing migration of a site to HTTPs and have applied a global filter that forces all non secure pages to their secure version via a 301 redirect.
There are a number of individual methods which have the RequireHttps attribute still applied to them, from when the site was a mix of secure and http pages.
Is there any downside or risk involved with leaving methods with these attributes given that the entire site will soon be HTTPs? I'll be removing them but it occurred to me that leaving them could slow things very slightly but most likely they would have little to no effect on the site.