3

I am developing a webGIS application with editable layers which uses transactional WFS through GeoServer to do CRUD operations in a PostGIS table. I was able to set up the authentication for wfs-t transactions in GeoServer and it works well: when i want to save the edits/new features a popup window appears with authentication request:

popuo window with authentication

if I type the correct username&password the transaction makes the geometry changes.

The security issue is: this authentication will be kept until the whole browser window is open, it's not enough to close the browser tab. It won't ask again for the authentication until you close the whole browser and reopen it.

So if you don't close the browser anybody can edit your layer.

Do you have any idea how to "sign out" to forget the authentication keys, without closing the whole browser window?

2
  • This not really a GIS question, so you might fare better if you post it on stackoverflow.com
    – TomazicM
    Jun 23, 2019 at 9:33
  • @BHadh did you need to configure anything in your application in order to get the authentication window appear? Or is it all within geoserver parameters?
    – user25976
    Aug 4, 2021 at 0:21

1 Answer 1

2

I found the solution. GeoServer uses basic HTTP authentication security, which is stored in a key until the user doesn't close the whole browser window. You can't sign out from it, just overwrite the authentication with fake username/password. This causes "logging off".

Just call this function (ajax needed):

      function logout() {
   $.ajax({
url: 'http://fakeusername:[email protected]:8080/geoserver/rece_wfs/ows',
type: 'post',
dataType: 'jsonp',
success: function(result){
//alert(result);
},
error: function(result){
//alert(you are logged out);
}
});  
}
2
  • 1
    You should NEVER use plain text authentication over unsecured http, always use https.
    – TomazicM
    Jun 24, 2019 at 11:14
  • 1
    True, need to enable https. I've checked this method in some browser, it only works in FireFox, eg. Chrome doesn't allow to send username/password in this way, so you can't "log out" from the authentication with this hack in Chrome.
    – BHadh
    Jun 25, 2019 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.