One of the features introduced with last December’s update to ArcGIS Online is the ability to update the layers in your web map to use HTTPS. With a cloud based SaaS such as ArcGIS Online, using HTTPS for communication over the internet is one of the most important steps you can do to secure sensitive information.
This post provides basic information on updating your web map layers to use HTTPS so that all data is securely transferred over the internet. Watch for a subsequent blog post that takes a closer look at HTTPS.
HTTPS, short for Hypertext Transfer Protocol for secure communication (and commonly referred to as SSL or TLS), allows for the secure transmission of data, both incoming and outgoing, between a client—such as a web browser—and the server. All data is encrypted, so anyone monitoring the traffic won’t be able to capture any sensitive information.
Updating your web map layers to use HTTPS is a simple way to help secure your intellectual property and prevent anyone other than the people you intend from seeing sensitive information. If your organization is already configured with HTTPS only, your maps likely reference layers using HTTPS or would you would be seeing mixed content issues. If your organization isn’t configured with HTTPS, it’s a good idea to begin updating your maps to use HTTPS. The popular browsers, such as Google Chrome, Mozilla Firefox, Microsoft Edge / Internet Explorer 11, and Apple Safari, are becoming increasingly stringent with HTTP traffic. Browser updates frequently introduce tighter controls that either alert you to security issues with websites or block insecure content completely.
Updating web maps to HTTPS
To update layers in a map to use HTTPS, go to the Settings tab in the map’s item page. In the Layer Settings section, click Update Layers to HTTPS.
After clicking Update Layers to HTTPS, a prompt displays to inform you that the layers in the web map will be updated to use HTTPS rather than HTTP, and that any layers in the map that reference layer items you own will also be updated to HTTPS. Note, if you do not own the referenced layer item but do have privileges to update it, the layer item will be updated. For instance, if you are an administrator in your ArcGIS Online organization, you can update both a map that you don’t own and the layer items referenced by the web map.
To proceed with the update, click Update Layers.
When updating layers to use HTTPS, ArcGIS Online will check each HTTP layer to make sure it supports HTTPS. Once all HTTP layers are checked, the web map will be updated to use HTTPS for all layers that support it. Once complete, you will see a report indicating which layers were successfully updated to HTTPS. Layers that were already HTTPS are reported as well. The report will also indicate if any associated layer items were updated to HTTPS.
That’s it! The layers in the web map should now use HTTPS when you view the map. Check the map by opening it in an HTTPS browser session (simply change the url from HTTP to HTTPS if your web map is not loaded as HTTPS already) and verify the layers draw as expected.
If a layer does not support HTTPS, you are notified that the layer could not be updated. To update the layer, the server providing the layer will need to be updated to support HTTPS. Once updated, the layer in the web map can then be updated to use HTTPS.
– When a layer is updated to HTTP, any custom symbols referenced by the layer are automatically updated to use HTTPS if the symbol source supports it.
– Layer configurations such as media embedded in pop-ups are not automatically updated to use HTTPS. To update these references, open the map in Map Viewer and update the references there.
– If an updated layer has an associated layer item, the referenced layer item is also updated to use HTTPS.