Tilelayers over HTTPS

[iH8]

Most providers have the protocol hardcoded in to the URL:

"url": "http://{s}.basemaps.cartocdn.com/{variant}/{z}/{x}/{y}.png"

Which throws mixed content errors to the console when loading using SSL:

Mixed Content: The page at 'https://example.org' was loaded over HTTPS, but requested an insecure image 'http://b.basemaps.cartocdn.com/light_all/12/1171/1566.png'. This content should also be served over HTTPS.

You could just go with protocol less/relative URL like some providers already have:

"url": "//{s}.tile.openstreetmap.org/{z}/{x}/{y}.png",

but that is considered an antipattern since there is no way of forcing SSL when you need it, so it would need a new option, something like this:

"url": "{protocol}://{s}.basemaps.cartocdn.com/{variant}/{z}/{x}/{y}.png"

I'de love to do a PR for you but i'm very unfamiliar with R

[jcheng5]

Thanks for the report!

Can you elaborate on "that is considered an antipattern since there is no way of forcing SSL when you need it"? Is there a case where the page is being served over http but you need the tiles to be served over https?

That said, we can't use "//..." because a common use of leaflet maps for R is creating .html files that are viewed over the file: protocol. Any objection to just hardcoding to https?

[iH8]

No problem, thanks for the quick response. Regarding the anti-pattern: https://www.paulirish.com/2010/the-protocol-relative-url/ but that is not really relevant when running local and using image files. Using SSL everywhere by hardcoding is fine with me, but i'm not the one affected, just reporting the issue. I help people out with Leaflet on SO and ran into someone with this problem so i thought i'de mention here. I'm not able to know how switching everything to SSL will affect your users. I see no problems but it's your decision.

[ndevln]

I also get a Mixed Content Warning when using https. For Carto Tiles there is already a fix: leaflet-providers. Leaflet for R still uses leaflet-providers 1.1.15 (9 Aug 2016). The newest version is 1.1.17 which doesn't contain the fix. So we just have to wait for the next version and update the configuration accordingly (or are these files unused?).

Edit:
But I could implement the workaround @iH8 mentioned on Stackexchange.

m <- leaflet() %>% addTiles('https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}.png',
                                        attribution = paste(
                                          '&copy; <a href="https://openstreetmap.org">OpenStreetMap</a> contributors',
                                          '&copy; <a href="https://cartodb.com/attributions">CartoDB</a>'
                                        ))

This works fine for me.

[bhaskarvk]

I've upgraded to the latest leaflet-providers in #476. Once merged this issue can be closed out.