4

This may appear to be a duplicate but I can't find any online source which is able to help me. Essentially, I want to protect a web Service from unauthorized access but still need to allow a web application to call the Service.

So, using ArcGIS Manager, I made a Service as "secure". After that, I launched: http://mygisserver/arcgis/tokens page, logged in and selected http referrer as default, entered the url of the web page hosting the web application like http://mywebserver/mygisapp/ and then generated a Token for 1 year.

Then, in the web application, I have http://mygisserver/arcgis/mysecureservice/mapserver?token=xxxxxxx for a ArcGISDynamicMapServiceLayer load parameter.

But running the web application I see an "Invalid Token" 498 error.

What could be happening? Is this even the right workflow or do I have to use some Proxy.

I don't want any login challenge for the users.

Update I am finding that the token is indeed working and the invalid token error I am getting are for the Legends and TOC widgets--somehow I need to pass the token to them. Hmmm.

Update 2 I am now trying to use the proxy.ashx. So I have defined the secure service's url in proxy.config, granted a new Arcgis Server user (say, proxy_culand) access to the locked service in Arcgis Manager, entered those credentials along with the url in the proxy.config file. After these, when I go to

http://mywebserver/proxy/proxy.ashx?http://mygisserver/arcgis/rest/services/CULAND/CU_LAND_v2a/MapServer then I still prompted for a password. Why is that?

Improve this question
4
  • In the ArcGIS Server token settings, what is the value of the max long-lived token? Is it set to 1 day (the default)?
    – Chad Cooper
    Commented Jun 18, 2015 at 1:48
  • Hi, I had changed the max days to 999 in the Token settings. So that should cover the 1 year selected during token generation.
    – IrfanClemson
    Commented Jun 18, 2015 at 11:12
  • How secure do you want your service to be? Appending the token to your URL in code means people can easily just look at your JS file and pull your token info, thus removing any security you might have. I have a similar set up out there, but I would prefer to be able to secure it using a proxy or other authentication method. Have you looked into proxy or setting up user authentication yet?
    – Branco
    Commented Jun 18, 2015 at 12:53
  • The token is setup in such a way that the web application will have to reside in a specific url--and so anyone grabbing the encrypted token wouldn't be able to use it--kind of like the Google Map API key. Am I right? I briefly looked into Proxy but couldn't figure out what to do. Thanks!
    – IrfanClemson
    Commented Jun 18, 2015 at 13:22

1 Answer 1

Reset to default
1

Here is how I am able to make it to work--at least on the local development environment.

As I had mentioned in Update 2 in the Question, I started using a NET Proxy.

So I created Tokens for allowed IP (which would be web server). Also created a proxy.ashx and in that, importantly, entered 'accessToken' attribute. Then, in my javascript code, calling this proxy.ashx.

Everything working except in case of Internet Explorer the icons/images for the Legends don't show---I can live with that for now.

Thanks.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.