2

I wan't to use the pg_featureserv service to deliver data from a PostgreSQL/PostGIS database to be displayed in Openlayers. The displayed maps are for internal use only, so the maps are only accessible when users are logged in.

Actually anybody calling the url of the pg_featureserv service directly http://map.mydomain.com:9000/collections/schema.areas/items.json has access to the data.

I wan't to restrict this, so that only the map-pages from the server (the same where the PostgreSQL/PostGIS and the pg_featureserv are runing on) have access to the data. But when I change the HttpHost settings to 127.0.0.1 or to the IP adress of our server, the data isn't displayed anymore in the Openlayers map.

The pg_featureserv.toml looks like this:

[Server]
# Accept connections on this subnet (default accepts on all)
# HttpHost = "0.0.0.0"
# HttpHost = "127.0.0.1"

HttpPort = 9000

UrlBase = "127.0.0.1:9000"

The requested data is displayed fine inside the Openlayers map.

      var areas = new ol.layer.Vector({
         source: new ol.source.Vector({
           url: "http://map.mydomain.com:9000/collections/schema.areas/items",
           format: new ol.format.GeoJSON()
         })
      });

      var map = new ol.Map({
        target: 'map',
        layers: [
          new ol.layer.Tile({
            source: new ol.source.OSM()
          }),areas
        ],
        view: new ol.View({
          center: ol.proj.fromLonLat([6.2, 49.6]),
          zoom: 12
        })
      });
3
  • I could add a proxy server inbetween to handle this, something like apache or nginx Nov 21 at 13:45
  • Maybe there is a confusion. With 'internal use' I didn't mean 'Intranet' but the use inside our company which operates from several sites. But maybe I'm missing something? @Timothy: May be You could indicate a more precise example or link how to realize this.
    – geom
    Nov 21 at 16:50
  • 1
    I was thinking something like in your vhost settings of apache/nginx you set up map.mydomain.com and proxy port 80 to 9000 to pg_featureserv and restrict this location, i.e. IP address ranges within your company. This way only users will be able to ask for the data that match this criteria. So somebody using your web app which asks for the data via openlayers will only get a response if the IP range matches. Nov 21 at 18:49
1

As mentioned in the comments, to do this you need a proxy server in front of pg_featureserv. Then use IP filtering or some sort of authentication to restrict access to only the users/machines allowed.

1
  • Many thanks for Your help. I'll see how to implement this.
    – geom
    Nov 26 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.