URL Checks

The URL External Access Checks page controls the checks that are performed on user provided URLs that GeoServer will use to access remote resources.

Currently, the checks are performed on the following functionality:

  • WMS GetMap, GetFeatureInfo and GetLegendGraphic requests with remote SLD stylesheets (sld parameter)

  • Remote icons referenced by styles (access to icons in the data directory is always allowed)

  • WMS GetMap and GetFeatureInfo requests in feature portrayal mode (REMOTE_OWS and REMOTE_OWS_TYPE parameters)

  • WPS remote inputs, either as GET or POST requests

Check this page for any additional remote service access checks added in the future.

Configuration of URL checks

Navigate to Data > URL Checks page to manage and configure URL Checks.


URL Checks table

Use the Enable/Disable URL Checks enable this safety feature:

  • When the URL checks are enabled checkbox is enabled, URL checks are performed to limit GeoServer access to remote resources as outlined above.

    Enabling URL checks is recommended to limit normal Open Web Service protocols interaction being used for Cross Site Scripting attacks.

  • When checkbox disabled, URL checks are NOT enabled, GeoServer is provided unrestricted access to remote resources.

    Disabling URL Checks is not a secure or recommended setting.

Adding a regular expression based check

The buttons for adding and removing URL checks can be found at the top of the URL Check list table.

To add a URL Check, press the Add new URL check button. You will be prompted to enter URL check details (as described in Editing a URL Check below).

Removing a regular expression based check

To remove a URL Check, select the checkbox next to one or more rows in the URL Check list table. Press the Remove selected URL checks button to remove. You will be asked to confirm or cancel the removal. Pressing OK removes the selected URL Checks.

Editing a URL Check

Regular Expression URL checks can be configured, with the following parameters for each check:




Name for the check, used to identify it in the list.


Description of the check, for later reference.

Regular Expression

A regular expression used to match allowed URLs


Check box to enable or disable the check


Configure Regular Expression URL check

Testing URL checks

The Test URL Checks with external URL form allows a URL to be checked, reporting if access is allowed or disallowed.

Test URL Checks form:



URL to check

Supply URL of external resource to check if access is allowed

Press the Test URL button to perform the checks. If at least one URL Check matches the URL, it will be allowed and the test will indicate the URL Check permitting access. Otherwise it will be rejected and the test will indicate that no URL Check matched.


Test URL Checks with external URL

Example RegEx Patterns

The most common pattern allows matching a given host name to allow external graphics from a remote server. This pattern uses ^ to mark the start, the host URL, .* to match anything, and $ to end - as shown in the in following pattern:



To allow external graphics from a specific directory on a remote server:



When working with external graphics making use of SVG parameters use (\?.*)?$ to optionally allow any query parameters after ?:



When obtaining content from an API \?.* is used (as there is no need to support relative paths). As an example /geoserver/ows\? is used below to access the GeoServer Open Web Service API:



To allow for GeoServer virtual web services (\w+/)? is used for optional workspace name:



To limit to Web Feature Service ?.*SERVICE=WFS.* is used to restrict query parameter:



To allowing WMS REMOTE_OWS data access to an external GeoServer WFS service:



To allow external graphic access to a remote GeoServer icons:



File paths can also be checked:






The locations being checked are normalizedmaking it easier to write RegEx patterns:

  • URLs paths have been normalized to remove any redundant \. or \.. paths have been removed

  • File URLs have been normalized so that file:/ is represented as file:///

  • File paths have been normalized using / on linux and \\ on windows


Web sites are available to help define a valid Java regular expression pattern. These tools can be used to interpret, explain and test regular expressions. For example: