This may appear to be a duplicate but I can't find any online source which is able to help me. Essentially, I want to protect a web Service from unauthorized access but still need to allow a web application to call the Service.
So, using ArcGIS Manager, I made a Service as "secure". After that, I launched: http://mygisserver/arcgis/tokens page, logged in and selected http referrer as default, entered the url of the web page hosting the web application like http://mywebserver/mygisapp/ and then generated a Token for 1 year.
Then, in the web application, I have http://mygisserver/arcgis/mysecureservice/mapserver?token=xxxxxxx for a ArcGISDynamicMapServiceLayer load parameter.
But running the web application I see an "Invalid Token" 498 error.
What could be happening? Is this even the right workflow or do I have to use some Proxy.
I don't want any login challenge for the users.
Update I am finding that the token is indeed working and the invalid token error I am getting are for the Legends and TOC widgets--somehow I need to pass the token to them. Hmmm.
Update 2 I am now trying to use the proxy.ashx. So I have defined the secure service's url in proxy.config, granted a new Arcgis Server user (say, proxy_culand) access to the locked service in Arcgis Manager, entered those credentials along with the url in the proxy.config file. After these, when I go to
http://mywebserver/proxy/proxy.ashx?http://mygisserver/arcgis/rest/services/CULAND/CU_LAND_v2a/MapServer then I still prompted for a password. Why is that?