I am developing a webGIS application with editable layers which uses transactional WFS through GeoServer to do CRUD operations in a PostGIS table. I was able to set up the authentication for wfs-t transactions in GeoServer and it works well: when i want to save the edits/new features a popup window appears with authentication request:

popuo window with authentication

if I type the correct username&password the transaction makes the geometry changes.

The security issue is: this authentication will be kept until the whole browser window is open, it's not enough to close the browser tab. It won't ask again for the authentication until you close the whole browser and reopen it.

So if you don't close the browser anybody can edit your layer.

Do you have any idea how to "sign out" to forget the authentication keys, without closing the whole browser window?


I found the solution. GeoServer uses basic HTTP authentication security, which is stored in a key until the user doesn't close the whole browser window. You can't sign out from it, just overwrite the authentication with fake username/password. This causes "logging off".

Just call this function (ajax needed):

      function logout() {
url: 'http://fakeusername:fakepassword@SERVER.IP.ADDRESS:8080/geoserver/rece_wfs/ows',
type: 'post',
dataType: 'jsonp',
success: function(result){
error: function(result){
//alert(you are logged out);
  • 1
    You should NEVER use plain text authentication over unsecured http, always use https. – TomazicM Jun 24 at 11:14
  • True, need to enable https. I've checked this method in some browser, it only works in FireFox, eg. Chrome doesn't allow to send username/password in this way, so you can't "log out" from the authentication with this hack in Chrome. – BHadh Jun 25 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.