If you go to GeoServer, layer preview, by clicking "KML" in the "Common formats" column you get a KML file that contains a URL that can be used to get all information for a layer. For example:


This is a WMS request (it contains service=WMS). I thought WMS requests only download images, but this request downloads the full data for the layer, including the coordinates of the lines (essentially the layer in vector format). I thought you'd need to use WFS for that.

The thing is that I want to permit a user to view the image of a layer (on a Leaflet map), but I don't want users to be able to download the data for the layer. I deactivated WFS for unauthorized users, but that isn't enough if they can get a KML with WMS.

What have I understood wrong? How can I fix this?

  • Basically, a WMS can server anything it wants provided it lists them in the getCapabilities document – Ian Turton May 6 '20 at 8:37
  • Pay attention to GetFeatureRequest as well. It can also use some vector format as INFO_FORMAT and even text/plain returns the attribute data. Consider what you want to publish and what to hide. – user30184 May 6 '20 at 9:07
  • Thanks a lot people! – Antonis Christofides May 6 '20 at 9:12
  • KML isn't a vector only format, you can serve images too. WMS can be used for vector tiles, and videos, not just images though that is it's commonest form. WMS gives a generalised view of one or more sets of data, not the actual data. – nmtoken May 6 '20 at 9:40

Browse other questions tagged or ask your own question.