Im about to implement a python script serving my openlayers code with GeoJson data from PostGIS. However, here How to connect OpenLayers to PostGIS data? I see " Unfortunately you cannot connect a web page directly to a database because of security concerns "

Could you please tell me about those concerns? Isnt using a proxy /server script good enough?

PS. I would ideally like to post in the above tread but lack the 50 reputation neccesary.. sorry about that.

  • For clarification I dont have access or the option to install GeoServer – giskis Dec 18 '13 at 12:35

You're reading too much into the "security concerns" comment. Basically he means you can't connect directly to the database, which is more true from a practicality point of view than from a security point of view. You're going to have something speaking HTTP between your web page and your database. It could be MapServer or GeoServer or FeatureServer. Or it could be a PHP/Perl/Python script you write yourself that does some minimal parameter reading and converting to SQL, returning JSON or whatever to the client.

If you write your own script, just be careful to follow the basics of web/database security:

  • Do not compose SQL by "sticking" + "together" + "strings" + "and values". Particularly don't paste values you receive from users together into SQL strings. Use prepared statements and parameter binding to pass values into SQL, to lower the odds of SQL injection attacks.
  • Create a very low privilege user to connect your script to your database, so the user has only the powers it needs, generally read-only access to the tables of interest, if you can get away with it.
  • Think about the worst, nastiest thing a user could pass into your script parameters and figure out how to avoid coming to harm from it. 10MB parameter input? Value that causes infinite loop? Whatever. Users are evil, remember that.

Really, spatial is NOT special in this case. You will have same security issues like with any other Web-Python-database interaction, be it blog, search engine or administrative dashboard. So, follow the common security rules (sanitizing user input, prepared statements, unprivileged user for reading data...) and you will be fine.


Rather than using GeoServer, try FeatureServer (check its demo). It supports (among others) PostGIS plus GeoJSON.

  • I dont have the option to install anything.. Must make do with PostGIS, python, javascript. Will that be a security risk and why? – giskis Dec 18 '13 at 13:41
  • to use FeatureServer you just need to download the file, unzipped it and add some paths as well as python stuff. So if you have installed python I don't think you will have problems. – Gery Dec 18 '13 at 13:45
  • Thanks, though I dont have direct access to server or authority to install due to a thight IT policy. So not an option.. But why is there a risk if im using python as a proxy? – giskis Dec 18 '13 at 13:49
  • no access?? well, that sucks, and why risk? have no idea, sorry about that. – Gery Dec 18 '13 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.