ArcGIS Basemaps Functionality Deprecation: HTTPS only

Description

Over the past few years, Esri has become more stringent about enforcing HTTPS only for online services and products in keeping with industry guidelines and best practices. As a follow up to enforcing HTTPS in ArcGIS Online in 2020, Esri is planning to make a similar change to the raster basemap environment. The Esri raster basemaps currently can be requested using HTTP or HTTPS protocols. Starting in April 2022, support for HTTP will be disabled, and tile requests will be HTTPS only. If an HTTP request is received, it will be redirected to HTTPS. In many cases, the redirect will work. We have found some cases where the redirect does not work, mostly under specific circumstances in developer applications. In these cases, developers will need to update their applications and tools to accommodate HTTPS.

Vector basemaps are not impacted since they are already HTTPS only. Anyone using Platform services is not impacted since basemaps are HTTPS only.

All raster basemaps are affected by this deprecation.  A list is available in this ArcGIS Online group. Note that the street based raster basemaps are in mature support, and we recommend that you use equivalent vector basemaps as a best practice. 

We strongly encourage all users to use HTTPS as a best practice for security and for optimal performance after HTTPS only is enforced. If a customer thinks they may be using HTTP to request Esri raster basemaps, they should start updating their applications now so that they do not experience any downtime starting in April 2022.

We are making this change for several reasons:

• HTTPS provides a secure connection whereas HTTP does not. This helps to protect users against malicious attacks from hackers.
• HTTPS is a requirement for FedRamp.

Recommendation

Esri recommends that everyone use HTTPS since it is more secure.

The basemap team has tested different scenarios, and the results are below.  Note that most usage is already HTTPS.  This table is focused only on those applications that may be sending HTTP requests.

Note:
The basemap team is still testing this deprecation, so the impact and notes may change.