Comments on: Securing your geometry in Arcims

By: Stc

Stc — Wed, 06 Jun 2007 09:37:20 +0000

Yes, we have maintanace contract, but I do not have confidence in local ESRI support, they won’t help as much… ACL would work well but I need GET_FEATURES in web-based client since I need to query, identify and search functions. I’m currently working on aliasing, but I know it can be penetrated. So I was thinking if I can make something like you mentioned in your article, but I have found nothing at all on internet about such a ‘frontend’. Could You enlight me, please?

By: Chris Tweedie

Chris Tweedie — Fri, 01 Jun 2007 08:38:36 +0000

Stc, i’d advise asking your local ESRI rep for assistance if you have a maintenance contract.

Otherwise, have a good look at what is possible with Access Control List’s. In most situations, limiting the GET_FEATURES call to a particular IP range solves most problems.

By: Stc

Stc — Thu, 31 May 2007 14:35:11 +0000

Hi Chris
Thanks for quick advice. Unfortunatelly we are still sticking with 9.0, so I was thinking to solve problem with downloadable geometry by so called “frontend” mentioned in this article.

By: Chris Tweedie

Chris Tweedie — Wed, 30 May 2007 15:50:24 +0000

Hi Stc,

Please have a look through the ESRI support forums as there are a lot of new options available in the 9.2 series. Much of the concerns raised in this article has since been resolved (to some extent)

By: Stc

Stc — Wed, 30 May 2007 14:30:33 +0000

Does enybody know where to fing guide or howto with impelmentation of mentioned “frontend” between Client and ArcIMS?

By: ArcIMS Security hole fixed? at Chris’ GISmo’s

ArcIMS Security hole fixed? at Chris’ GISmo’s — Thu, 17 Aug 2006 05:29:37 +0000

[...] I had actually pointed out this fatal security flaw in an earlier post last year … but its good to see its now “fixed”. I’m interested in how the 9.2 support tools such as ArcExplorer or even ArcGIS will handle connecting to ArcIMS services as i am pretty certain they use the feature request for rendering … maybe they are just using GET_IMAGE requests now? [...]