I use geodjango to create and serve tiles that I usually display into OpenLayers as openLayers.Layer.TMS

I am worried that anybody could grab the tms URL and plug it into their own map without asking permission, and then consume a lot of the server's CPU and violate private data ownership. On the other hand, I want the tile service to be publicly available without login, but from my website only.

Am I right to think that such violation is possible? If yes, what would be the way to be protected from it? Is it possible to hide the url?


I am going to suggest you do something like an API key like Google or CloudMade. That way you can only allow keys to make requests.

Here are a few items I googled up on the topic.

https://github.com/scoursen/django-apikey & http://www.stevecoursen.com/665/django-apikey-key-based-authorization-for-restful-django-applications/

CloudMade documentation: http://developers.cloudmade.com/projects/tiles/documents

I would just set a key each day for your application so it can access the data, but otherwise without a valid key others cannot access your endpoint. Then later if you wanted to provide access you could then extend it easily.

  • very interesting! So I could change a key in the URL each day... – Below the Radar Jun 6 '13 at 20:31
  • Yes or more often. – Jamie Jun 7 '13 at 4:32

You should consider using this http://www.django-rest-framework.org/api-guide/authentication/#tokenauthentication (and read that page for more ideas).

By using the Django REST Framework's authentication token method you can auto-relate every user that has registered to your application with a unique token, that you can enforce them using it to make any kind of RESTful request (GET, POST etc.) to your API.

Happy coding :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.