I have a tile server (apache2 + mod_tile serving OpenStreetMap data) that I'm going to use via Leaflet. Everything's working fine but before putting this public, I have a big concern about the security of this set up.
If I just make my server public, anyone will be able to point their own Leaflet / OpenLayers / whatever to my tile server and use it inadvertently and without authorization.
What's the best approach to make it safer?
I thought of a few possible solutions:
I could use Apache to restrict the origin of the request
Pro: easy to implement
Con: easy to forge and bypass
I could issue some sort of key and use it to validate the requests
Pro: relatively easy to implement
Con: also easy to steal
I could build my own authorization service to be between the clients and the tile server with more sophisticated techniques to avoid unauthorized uses
Pro: relatively safe
Con: harder to implement and may also add some significant latency when validating every single tile request
What do you guys suggest? I have the impression that if I just make the tile server public it's a matter of time until somebody starts abusing it. Is there any best practice when hosting your own OpenStreetMap solution?
The solution is hosted on AWS so any solution involving AWS stack is valid