topic Re: Problem with http/https in ArcGIS JavaScript Maps SDK Questions

Problem with http/https

JiriStrnad — Fri, 13 Jul 2018 05:57:03 GMT

Hi,

i have configuration file with services. Services are available from unsecure protocol (http - only).

When i create instance for examle of FeatureLayer, service is called from https. I have in browser CORS enabled (Chrome with plugin), but that would not affect, when service is called from secure protocol. I tried adding the server to config (corsEnabledServer), but not working... I work with API version 4.8. Interesting is, that version 4.7 work.

Re: Problem with http/https

Stacy-Rendall — Fri, 13 Jul 2018 21:00:28 GMT

It seems that the 4.8 API is upgrading all feature layer requests (haven't tested other request types) to HTTPS. If your server is not serving on HTTPS this causes problems.

This appears to be a bug with 4.8, as it is not mentioned in the release notes or Feature Layer documentation.

Re: Problem with http/https

ReneRubalcava — Fri, 13 Jul 2018 22:33:32 GMT

The update was done to avoid mixed content errors. There should be no change if your application is running on http, but if your app is running on https, we upgrade the requests.

If you're running on localhost though, localhost validates as true for isSecureContext.

To avoid this issue when developing on localhost, you can create a self-signed cert for your machine. This is a nice repo to look at. GitHub - FiloSottile/mkcert: A simple zero-config tool to make locally trusted development certificates with any names y…

We're going to be updating our documentation to reflect this.

Re: Problem with http/https

Stacy-Rendall — Sun, 15 Jul 2018 02:35:58 GMT

But the feature service is not secure. Does this now mean you cannot develop on localhost if you have HTTP services?

Re: Problem with http/https

ReneRubalcava — Sun, 15 Jul 2018 16:52:46 GMT

We're still testing how viable it would be to white list localhost in the API, but your best option at the moment is add self-signed certs to your local machine. That link above is one route, and there are others depending on your local needs.

We'll update this thread with any more info.

Thanks!

Re: Problem with http/https

Stacy-Rendall — Sun, 15 Jul 2018 20:41:20 GMT

I feel like we are talking at cross-purposes, can you please actually read what I am saying?

If your local machine has a self-signed certificate and you are running on HTTPS localhost then HTTP feature services will be blocked, as that is mixed content:

dojo.js:152 Mixed Content: The page at 'https://localhost:8080/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://...'

If you are running on HTTP localhost then HTTP feature services are automatically upgraded to HTTPS and cannot be accessed as they don't exist.

Unless there is some other method, setting or flag that has not been mentioned up until now: how do you access HTTP services if you are developing on localhost?

Re: Problem with http/https

ReneRubalcava — Sun, 15 Jul 2018 23:27:04 GMT

Yes, you're correct, I was thinking of repro'ing a prod env as much as possible. I was able to repro this at one time, but now I'm having trouble, as everything I'm testing works. Do your URLs look like "http://gisdev/arcgis/rest..." using a machine name and not a full domain?

Re: Problem with http/https

Stacy-Rendall — Mon, 16 Jul 2018 02:25:52 GMT

Thanks Rene, no - it is a full domain...

Re: Problem with http/https

JonGarrido — Tue, 17 Jul 2018 09:04:55 GMT

I have had a similar issue when migrating from 4.7 to 4.8. My FeatureLayer services and MapImageServices are redirected to https in a localhost dev environment. To solve it what I have done is to add a fake domain to my hosts file on windows (C:\Windows\System32\drivers\etc) , for example:

127.0.0.1 test-ieo.com

Now my dev app is running on test-ieo.com:3000/ in addition to localhost:3000/. In the test-ieo.com url is working fine!!

I hope this can be useful for someone...

Jon

Re: Problem with http/https

Stacy-Rendall — Tue, 17 Jul 2018 20:49:30 GMT

Yes - this solves it! Using this solution: instead of accessing the page through localhost, which evaluates to secure environment and thus upgrades request to HTTPS (which doesn't exist for HTTP services), the fake domain does not evaluate to secure, so doesn't upgrade the request, thus allowing you to access the HTTP service over HTTP. Thanks Jon Garrido!

Re: Problem with http/https

Stacy-Rendall — Tue, 17 Jul 2018 20:51:01 GMT

Just be careful to choose a fake domain that either doesn't exist or that you don't care about, as it will override the real domain if you try to go to it...

Re: Problem with http/https

VladimirStrinski — Tue, 27 Nov 2018 01:48:32 GMT

Just my 2c -

Although I understand the reasoning behind I think the specific solution is causing more trouble than helping.

If possible I'd like to have an option or a switch in the API whether I want this extra behavior, or I'd rather see the mixed content warning messages in the console.

There are valid business scenarios when serving and accessing pages and layers via localhost is needed. In such cases HTTP is a good solution. By adding a fake certificate to fake security we are merely masking the issue, and not necessarily adding any security. It is rather the opposite - adding and trusting an insecure certificate that shouldn't be trusted. Imagine the case where a department with hundreds of computers will need to have a fake certificate generated and be made trusted on each of those machines.

Separately from all that, the "isSecureContext" is still an experimental technology (as per the MDN page), and that behavior may change by the time it becomes an official standard.

Re: Problem with http/https

DavidSchontzler — Tue, 27 Nov 2018 17:29:58 GMT

I were experiencing the same problem, but as this is a customer project I cannot edit HOSTS files to get around the issue. I concur with Vladimir:

Vladimir Strinski wrote:
There are valid business scenarios when serving and accessing pages and layers via localhost is needed. In such cases HTTP is a good solution.

Whitelisting localhost would be nice, but if that is not easily done please please please provide a configuration option that will not automatically upgrade our URLs.

Re: Problem with http/https

DavidSchontzler — Wed, 28 Nov 2018 17:40:39 GMT

Localhost has been whitelisted in 4.9: Release notes for 4.9 | ArcGIS API for JavaScript 4.9

Re: Problem with http/https

RubyStroschein — Thu, 21 Mar 2019 10:40:18 GMT

Also esri services do not support https and CORS? I can't use Geometry service

Access to XMLHttpRequest at 'https://tasks.arcgisonline.com/ArcGIS/rest/services/Geometry/GeometryServer/project' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Re: Problem with http/https

sapnas — Wed, 13 Nov 2019 15:30:22 GMT

Have you tried using http://tasks.arcgisonline.com/ArcGIS/rest/services/Geometry/GeometryServer/project instead. You need to replace https with http or enable ssl for your local host to access https geometry service