Is OpenLayers proxy access secured?

Question

I have secured my layers on Geoserver. Users can not access my layers without authenticated username and password.

Now, I created a proxy script with PHP. Proxy script sends request with username password.

http://myproxydomain.com/proxy.php is my proxy address.

And I am using this proxy on my OpenLayers application to access WMS and WFS:

  OpenLayers.ProxyHost="http://myproxydomain.com/proxy.php?url=";

  var myWMSLayer = OpenLayers.Class(OpenLayers.Layer.WMS, {

      getURL: function (bounds) {
         var url = OpenLayers.Layer.WMS.prototype.getURL.call(this, bounds);
         if (OpenLayers.ProxyHost && OpenLayers.String.startsWith(url, "http")) {
             url = OpenLayers.ProxyHost + encodeURIComponent(url);
         }
         return url;
      }
   });

As a result, everyone can use my services that knows my proxy url. My application is in Javascript and you can see my proxy url from browser view code. And you can add your my proxy to your own Openlayers application and access my layers.

How can I solve this problem?

Answer 1

More the concept than the exact solution:

Solution 1:

Use CORS. It's done to manage exchange so you can allow access to some resources only if they come from a particular website.

It's by playing with server side header and also by changing on client side the Ajax calls to provide "right" headers it will works.

Settings Cors can be done at PHP proxy level or at Java container level (such as TomCat)

One of the main website to understand Cors is http://enable-cors.org

Solution 2:

A more simple alternative to CORS is to rely on using GeoServer built-in security

Answer 2

You need to have your users authenticate somehow in your application and store the PHP Session Id and some other identifier in the session. Assuming that your proxy is on the same Url (no CORS issues) the Session ID and identifier will be available to your Proxy Script.

Simply check that the stored session Id from the Login matches the Session Id used by the proxy and that the identifier is the one set AFTER the authentication is completed.

If the session id's are different, it is a direct hit on your proxy. If the identifier is not set or incorrect, then that session did not pass authentication and not authorized by your application to access your layers.

On our implementation, we do not use any Geoserver Authentication, but have implemented security in the proxy itself. Our users log-in via an application (not Geoserver) log-in page, a look up is done on a database to see what layers that user is authorized to see and that information is stored in the session.

Our Proxy Script then checks that the sessions match, checks the WMS Url and verifies that the layer is in the Authenticated Layers List in the Session.