Tell me more ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Is there a way to send username and password parameter to a wms layer that needs authorization?

If not, I guess it's perhaps a non-spatial thing to solve so that you before the javascript sends a wms request you initiate a httprequest to the server where the wms service is hosted. If anyone have an good example of how to do that from java, html or javascript I would really appreciate it.

If you use firefox you could add http:\username:password@wmsurl and its solved and the information is the stored in the session/cache ...

Thanks for the help Mike

share|improve this question

3 Answers

up vote 2 down vote

It's not the work of WMS server that do the authorization, but the HTTP server. Usually we save logged in user's information in the sessions and provide those information when requesting to a WMS server in the cookies.

share|improve this answer
Could you please provide an example? I have tried: try { URL url = new URL ("geoserver/…); String encoding = Base64Encoder.encode ("user:passw"); HttpURLConnection con= (HttpURLConnection) url.openConnection(); con.setRequestMethod("POST"); con.setDoOutput(true); con.setRequestProperty ("Authorization", "Basic " + encoding); InputStream content = (InputStream)con.getInputStream(); } catch(Exception e) { e.printStackTrace(); } – Mike001 Jan 28 at 14:42
I do not have much experience in Java, but nowadays web application frameworks, like spring for java, usually comes with a security module that do the authentication and authorization work in a secure way. I would suggest to use some web frameworks if you are making something serious, otherwise you'll have to reinvent the wheel and it requires much effort to deal with common security issues like cross site scripting, javascript/SQL injection, etc. – Mingfeng Jan 29 at 8:00
up vote 1 down vote

I don't know if it's the best solution, and for now I have only managaged to get it to work on IE 8 (because of cross site scripting), but it works for now. If anybody have a solution to solve the cross site scripting it would be great. This solution will also mean that the username and password will vissible in the javascript, but thats not an issue for me.

jQuery.support.cors = true;
$.ajax(
                {
                  'password' : 'your_password',
                  'username' : 'your_username',
                  'url'      : url,
                  'type'     : 'POST',
                  'success'  : function(){   },
                  'error'    : function(err){ },
                }
        );
share|improve this answer
up vote 0 down vote

This question is a duplicate of (OpenLayers 2.12 and http basic authentication woes).

A possible solution (my answer, of course :) is to do an ajax call to the WMS service, and let the browser to handle the http authentication, and add the layer after the user is authenticated

share|improve this answer
But in your solution you still have the cross site scripting problem, dont you? – Mike001 Jan 29 at 11:44
@Mike001 Yes, but it should be possible to avoid xss restricions using data:'jsonp' in the jQuery request (or crossDomain: true), as explained in (api.jquery.com/jQuery.ajax) – Tommaso Jan 29 at 15:40
>But if it is a wms layer that needs authorization, you cant use jsonp format can you? If so I have done it wrong when I tried. Or rather, it works in IE8 (but I get the same warning message as when not using jsonp), but not on Firefox or Chrome. My code is jQuery.support.cors = true; $.ajax( { 'password' : 'passw', 'username' : 'user', 'url' : url, 'type' : 'POST', 'datatype' : 'jsonp', 'crossDomain' : true ,'success' : function(){ alert("succ") }, 'error' : function(err){ alert("Err" + err)}, } ); – Mike001 Jan 30 at 8:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.