Insecure content while editing a confluence page

[Lars Müller]

Hi experts,

I think I found an error in confluence. My base URL is set correctly "https://" but while using e. g. the "Info" macro, the Chrome browser shows an insecure connecton.

In the network log with the dev tools of chrome I found the connections, made by the info macro (my base url but without "s" of "https".

How can I fix this?

And: The Draw.IO plugin also makes a "http" connection, probably to their servers.

Edit 15.04.2020: In case of the "info" macro and the Draw.IO plugin happen "http" connections just internal, though the base url is set correctly "https".

Regards

Lars

[Lars Müller]

Can anyone from Atlassian help me?

[David Benson _draw_io_]

Can you show the network tab of the browser debugger where draw.io makes this call?

[Lars Müller]

GET /confluence/plugins/servlet/confluence/placeholder/macro-heading?definition=e2RyYXdpbzpib3JkZXI9dHJ1ZXxkaWFncmFtTmFtZT1VbmJlbmFubnRlcyBEaWFncmFtbXxzaW1wbGVWaWV3ZXI9ZmFsc2V8d2lkdGg9fGxpbmtzPWF1dG98dGJzdHlsZT10b3B8bGJveD10cnVlfGRpYWdyYW1XaWR0aD0xNDUxfHJldmlzaW9uPTF9&locale=de_DE&version=2 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36

With our base-URL (configured as https) but just as http at the beginning.

It is the Image of the row:

[David Benson _draw_io_]

That's a local call to your Confluence instance by Confluence, not draw.io. It happens to get the draw.io icon, yes, but it's not the plugin making the call. Someone from Atlassian would need to answer that.

To be clear, draw.io does call remotely draw.io servers from a user's browser at any time.