Is there a way to send username and password parameter to a wms layer that needs authorization?

If not, I guess it's perhaps a non-spatial thing to solve so that you before the javascript sends a wms request you initiate a httprequest to the server where the wms service is hosted. If anyone have an good example of how to do that from java, html or javascript I would really appreciate it.

If you use firefox you could add http:\username:password@wmsurl and its solved and the information is the stored in the session/cache ...

Thanks for the help Mike

3 Answers 3


It's not the work of WMS server that do the authorization, but the HTTP server. Usually we save logged in user's information in the sessions and provide those information when requesting to a WMS server in the cookies.

  • Could you please provide an example? I have tried: try { URL url = new URL ("geoserver/…); String encoding = Base64Encoder.encode ("user:passw"); HttpURLConnection con= (HttpURLConnection) url.openConnection(); con.setRequestMethod("POST"); con.setDoOutput(true); con.setRequestProperty ("Authorization", "Basic " + encoding); InputStream content = (InputStream)con.getInputStream(); } catch(Exception e) { e.printStackTrace(); }
    – Mike001
    Jan 28, 2013 at 14:42
  • I do not have much experience in Java, but nowadays web application frameworks, like spring for java, usually comes with a security module that do the authentication and authorization work in a secure way. I would suggest to use some web frameworks if you are making something serious, otherwise you'll have to reinvent the wheel and it requires much effort to deal with common security issues like cross site scripting, javascript/SQL injection, etc.
    – mfdev
    Jan 29, 2013 at 8:00

I don't know if it's the best solution, and for now I have only managaged to get it to work on IE 8 (because of cross site scripting), but it works for now. If anybody have a solution to solve the cross site scripting it would be great. This solution will also mean that the username and password will vissible in the javascript, but thats not an issue for me.

jQuery.support.cors = true;
                  'password' : 'your_password',
                  'username' : 'your_username',
                  'url'      : url,
                  'type'     : 'POST',
                  'success'  : function(){   },
                  'error'    : function(err){ },

This question is a duplicate of (OpenLayers 2.12 and http basic authentication woes).

A possible solution (my answer, of course :) is to do an ajax call to the WMS service, and let the browser to handle the http authentication, and add the layer after the user is authenticated

  • But in your solution you still have the cross site scripting problem, dont you?
    – Mike001
    Jan 29, 2013 at 11:44
  • @Mike001 Yes, but it should be possible to avoid xss restricions using data:'jsonp' in the jQuery request (or crossDomain: true), as explained in (api.jquery.com/jQuery.ajax)
    – Tommaso
    Jan 29, 2013 at 15:40
  • >But if it is a wms layer that needs authorization, you cant use jsonp format can you? If so I have done it wrong when I tried. Or rather, it works in IE8 (but I get the same warning message as when not using jsonp), but not on Firefox or Chrome. My code is jQuery.support.cors = true; $.ajax( { 'password' : 'passw', 'username' : 'user', 'url' : url, 'type' : 'POST', 'datatype' : 'jsonp', 'crossDomain' : true ,'success' : function(){ alert("succ") }, 'error' : function(err){ alert("Err" + err)}, } );
    – Mike001
    Jan 30, 2013 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.