I’m using the WMS/WFS provided from a project i have published via LWC. Those WMS/WFS data are not protected and out in the world wide web. Can i somehow put them behind a password? I can set that only certain users of lizmap can see the WMS/WFS url, but knowing Lizmap, one could pretty easyily guess/construct the URLS of foreign projects - so that is quite a security hole imho!
Do I understand correctly: The Lizmap project is to be publicly accessible, but the corresponding services are not?
This means that anyone can view the data in Lizmap but should not be able to use the corresponding services.
Interesting question!
No, sorry if i did not express it clear: the Lizmap project is not public accessible - but the WFS/WMS URL which i can retrieve as admin is - no username/password needed to access the WFS data, only the URL is needed. And this URL can be easily guessed, right?
In my case, if a project was secured by access data (user name/password), then the WMS/WFS service was secured in the same way.
However, I have not yet tested this in version 3.9.
Do you use the link for the WMS/WFS services from the Lizmap project metadata or is this internal use?
I always use the former.
Hmm, really? If i copy the WFS URL from the Lizmap Metadata Information panel (when beeing logged in as admin) i can paste it into any GIS software and i can see and load all layers - without password prompt.
I just checked with my last 3.8.11 project - same here, i can simply copy the WMS URL from the metadata and access all layers without beeing asked for username/pwd
The access restrictions work perfectly!
Just not on the same PC!
Test the WMS/WFS service from another PC and you will be asked for the access data:
Your own PC apparently remembers them.
I don’t think that used to be the case and I’m not sure whether I like it or not.
tested with Lizmap 3.9.1
1 Like
Wow, that is kind of mindblowing. How does my QGIS know, that when i create a new connection to that wfs, what the password is? Magic done by 3liz! Hehe, great, thanks @wagner-it for pointing that out. I can live with that so far.
@gustry can you maybe explain from where QGIS knows the connection data?