I have a tile server (apache2 + mod_tile serving OpenStreetMap data) that I'm going to use via Leaflet. Everything's working fine but before putting this public, I have a big concern about the security of this set up.

If I just make my server public, anyone will be able to point their own Leaflet / OpenLayers / whatever to my tile server and use it inadvertently and without authorization.

What's the best approach to make it safer?

I thought of a few possible solutions:

  1. I could use Apache to restrict the origin of the request

    Pro: easy to implement

    Con: easy to forge and bypass

  2. I could issue some sort of key and use it to validate the requests

    Pro: relatively easy to implement

    Con: also easy to steal

  3. I could build my own authorization service to be between the clients and the tile server with more sophisticated techniques to avoid unauthorized uses

    Pro: relatively safe

    Con: harder to implement and may also add some significant latency when validating every single tile request

What do you guys suggest? I have the impression that if I just make the tile server public it's a matter of time until somebody starts abusing it. Is there any best practice when hosting your own OpenStreetMap solution?

The solution is hosted on AWS so any solution involving AWS stack is valid

  • Are you trying to protect the data, or avoid AWS cost?
    – BradHards
    Oct 26, 2017 at 21:49
  • @BradHards the main goal is to avoid AWS costs since there's no sensitive data here, just plain old map tiles Oct 26, 2017 at 22:40
  • 1
    Then I wouldn't worry about it until you actually have a problem, because there are other providers (including OSM) that are probably easier than your service, so a basic key / check would probably be enough if you want to do anything at all.
    – BradHards
    Oct 27, 2017 at 1:16

1 Answer 1


Another option - use mod_tile's built-in throttling capabilities. There's an OSM help answer over at https://help.openstreetmap.org/questions/40563/how-to-block-tiles-for-some-users , or try web searches for "ModTileEnableTileThrottling", "ModTileThrottlingTiles" and "ModTileThrottlingRenders"

Not the answer you're looking for? Browse other questions tagged or ask your own question.