[Geoserver-users] Isolating geoserver usage

"I don't know what referral checks are thought... did a search on
Google, found nothing. Care to elaborate? :)"

He probably meant referrer checks ....

Best regards,
Bart

--
Bart van den Eijnden
OSGIS, Open Source GIS
http://www.osgis.nl

--------- Oorspronkelijk bericht --------
Van: Andrea Aime <aaime@anonymised.com>
Naar: Pieter Jansen <pjansen@anonymised.com>
Cc: geoserver-users@lists.sourceforge.net
Onderwerp: Re: [Geoserver-users] Isolating geoserver usage
Datum: 09/10/07 10:23

Pieter Jansen ha scritto:
&gt; Hi,
&gt;
&gt; What methods can be applied to isolate the geoserver usage to only a
&gt; set of allowed clients or client contexts? Serving WMS publicly is a
&gt; requirement, otherwise the viewer can't access it.
&gt;
&gt; Within HTTP this problem has been &quot;fixed&quot; by implementing

referal

&gt; checks. Can anything similar be done within Geoserver/wms, or is a
&gt; manual lockdown (xml firewall) needed?

In GeoServer 1.6.x we have a prototype of role based access control
that can be used to limit access to clients, and it's using http
basic authentication as the means to check the user identity.
Yet, as you say, some clients aren't able to use it.

I don't know what referral checks are thought... did a search on
Google, found nothing. Care to elaborate? :slight_smile:

Cheers
Andrea

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now &gt;&gt; http://get.splunk.com/
_______________________________________________
Geoserver-users mailing list
Geoserver-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-users

On 10/9/07, Bart van den Eijnden (OSGIS) <bartvde@anonymised.com> wrote:

"I don't know what referral checks are thought... did a search on
Google, found nothing. Care to elaborate? :)"

He probably meant referrer checks ....

Referrer == referral :wink:

When writing web aplications, you can check for a 'Referrer: ' header,
which contains the original page URL the browser was visiting when
deciding to go for the current request.

Websites use this a lot for determining if someone is deeplinking to images.

In geoserver, we could do the following:
- allow certain User-Agent's
- set a special magic cookie which only our client and geoserver know about
- verify if the referrer URL is originating from our expected start URL

Kind regards,

Pieter