The URL External Access Checks page controls the checks that are performed on user provided URLs that GeoServer will use to access remote resources.
Currently, the checks are performed on the following functionality:
WMS GetMap, GetFeatureInfo and GetLegendGraphic requests with remote SLD stylesheets (
Remote icons referenced by styles (access to icons in the data directory is always allowed)
WMS GetMap and GetFeatureInfo requests in feature portrayal mode (
WPS remote inputs, either as GET or POST requests
Check this page for any additional remote service access checks added in the future.
Configuration of URL checks¶
Navigate topage to manage and configure URL Checks.
Use the Enable/Disable URL Checks enable this safety feature:
When the URL checks are enabled checkbox is enabled, URL checks are performed to limit GeoServer access to remote resources as outlined above.
Enabling URL checks is recommended to limit normal Open Web Service protocols interaction being used for Cross Site Scripting attacks.
When checkbox disabled, URL checks are NOT enabled, GeoServer is provided unrestricted access to remote resources.
Disabling URL Checks is not a secure or recommended setting.
Adding a regular expression based check¶
The buttons for adding and removing URL checks can be found at the top of the URL Check list table.
To add a URL Check, press the Add new URL check button. You will be prompted to enter URL check details (as described in Editing a URL Check below).
Removing a regular expression based check¶
To remove a URL Check, select the checkbox next to one or more rows in the URL Check list table. Press the Remove selected URL checks button to remove. You will be asked to confirm or cancel the removal. Pressing OK removes the selected URL Checks.
Editing a URL Check¶
Regular Expression URL checks can be configured, with the following parameters for each check:
Name for the check, used to identify it in the list.
Description of the check, for later reference.
A regular expression used to match allowed URLs
Check box to enable or disable the check
Testing URL checks¶
The Test URL Checks with external URL form allows a URL to be checked, reporting if access is allowed or disallowed.
Test URL Checks form:
URL to check
Supply URL of external resource to check if access is allowed
Press the Test URL button to perform the checks. If at least one URL Check matches the URL, it will be allowed and the test will indicate the URL Check permitting access. Otherwise it will be rejected and the test will indicate that no URL Check matched.
Example RegEx Patterns¶
The most common pattern allows matching a given host name to allow external graphics from a remote server. This pattern uses
^ to mark the start, the host URL,
.* to match anything, and
$ to end - as shown in the in following pattern:
To allow external graphics from a specific directory on a remote server:
When working with external graphics making use of SVG parameters use
(\?.*)?$ to optionally allow any query parameters after
When obtaining content from an API
\?.* is used (as there is no need to support relative paths). As an example
/geoserver/ows\? is used below to access the GeoServer Open Web Service API:
To allow for GeoServer virtual web services
(\w+/)? is used for optional workspace name:
To limit to Web Feature Service
?.*SERVICE=WFS.* is used to restrict query parameter:
To allowing WMS
REMOTE_OWS data access to an external GeoServer WFS service:
To allow external graphic access to a remote GeoServer icons:
File paths can also be checked:
The locations being checked are normalizedmaking it easier to write RegEx patterns:
URLs paths have been normalized to remove any redundant
\..paths have been removed
File URLs have been normalized so that
file:/is represented as
File paths have been normalized using
/on linux and
Web sites are available to help define a valid Java regular expression pattern. These tools can be used to interpret, explain and test regular expressions. For example:
https://regex101.com/ (enable the Java 8 flavor)