Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

In a project the customer wants the images of the WMS to be secured against unauthorized access. What are the common solutions to realize that? Are they compatible with the OGC-standards?

share|improve this question

7 Answers 7

The OGC spec only mandates the use of http. If it is compliant http it should be okay.

Some possible methods:

  • HTTP Basic Authentication (password sent as plain text, may have limited client support)
  • HTTP Digest Authentication (more secure, may have limited client support)
  • Filter IP address of client (easy to implement but not particularly secure).
  • Secret URL. Use a GUID to generate an un-guessable URL. Assumes that clients will keep URL secret. Much simpler for user to use than password entry. Guaranteed client support.
share|improve this answer

This OGC post from 2005 says:

There are no specific security aspects that are part of the OGC WMS/WFS/WCS Interface Specifications. Instead, security and authentication is best handled at another layer in the processing stack.

share|improve this answer

If security through obscurity is enough for your purposes you might configure a false extend for the layer :

Just use coordinates on the other side of the Earth. The layer will still appears in the layer list, requests will still be possible but if a user simply select it in a GIS software and choose "zoom to layer" he will not see anything and might think that this layer is simply empty or does not work. An application knowing the correct extend of the layer should still be able to access it.

I have already seen this solution applied on some WMS sites, but it is probably not completly conform to OGC-standards as the server returns an incorrect extend.

share|improve this answer

You can require that users connect to the WMS over HTTP secured by a VPN. It puts the security layer on the level of the IP network, but certainly adds complexity.

share|improve this answer

There are also specialized frameworks like SecureOWS by CampToCamp : http://www.secureows.org/trac/secureows

share|improve this answer

http://52north.org/communities/security/general/user_guide.html http://geoprisma.org/site/index.php



share|improve this answer

You can use a framework on top of Mapserver to enable WMS/OWS authentication. Here is a list obtained from a post to the mapserver-users mailing list.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.