Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use geodjango to create and serve tiles that I usually display into OpenLayers as openLayers.Layer.TMS

I am worried that anybody could grab the tms URL and plug it into their own map without asking permission, and then consume a lot of the server's CPU and violate private data ownership. On the other hand, I want the tile service to be publicly available without login, but from my website only.

Am I right to think that such violation is possible? If yes, what would be the way to be protected from it? Is it possible to hide the url?

share|improve this question

I am going to suggest you do something like an API key like Google or CloudMade. That way you can only allow keys to make requests.

Here are a few items I googled up on the topic. &

CloudMade documentation:

I would just set a key each day for your application so it can access the data, but otherwise without a valid key others cannot access your endpoint. Then later if you wanted to provide access you could then extend it easily.

share|improve this answer
very interesting! So I could change a key in the URL each day... – Below the Radar Jun 6 '13 at 20:31
Yes or more often. – Jamie Jun 7 '13 at 4:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.