Some imagery providers don't respect the protocol at the front of their own endpoint URLs

I am trying to report a different issue and wanted to use Sandcastle as an example. I clicked “Open In New Tab”, and the globe loaded with pure-blue imagery. The console shows “mixed-content” errors, and all the (blocked) network requests were being made to http://ecn.t2.tiles.virtualearth.net/tiles even though Sandcastle itself loads over HTTPS.

The page’s URL shows as blob:https://cesiumjs.org/{a guid}; perhaps for some reason protocol-relative URLs are resolving to HTTP instead of HTTPS in this case?

[ggetz]

Thanks for reporting this @thw0rted !

[emackey]

And guess what, even though createDefaultViewModelImageryProviders switched to all-https years ago, the change never took effect. If you load CesiumViewer from an insecure page, you’re still making insecure requests back to Bing. Even though the construction parameters of the imagery provider included a URL specifically with https on the front, that’s being overridden with http here based on the document protocol being either blob or http.