Open ankhili opened 4 years ago
Data KEY : n3bmjg0te91vxwdf5gwayf70 Error when add a WMS in portal with esrifrance Referer.
Headers response :
_
Request URL: https://maps.esrifrance.fr/portal/sharing/proxy?https://wxs.ign.fr/n3bmjg0te91vxwdf5gwayf70/geoportail/r/wms?SERVICE=WMS&REQUEST=GetCapabilities&VERSION=1.3.0 Request Method: GET Status Code: 500 Internal Server Error Remote Address: 195.154.134.75:443 Referrer Policy: no-referrer-when-downgrade Cache-Control: private Connection: close Content-Length: 949 Content-Type: text/html;charset=utf-8 Date: Tue, 12 Nov 2019 14:22:10 GMT Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Microsoft-IIS/8.5 Server: Vary: Origin X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Accept: / Accept-Encoding: gzip, deflate, br Accept-Language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7 Connection: keep-alive Cookie: _ga=GA1.2.2115850218.1568122149; esri_auth=%7B%22portalApp%22%3Atrue%2C%22email%22%3A%22ankhili_esrifrance%22%2C%22token%22%3A%22BsJNiqhL7A9CwD9lVJtUgJ9sydoVcM1uZlgKRFQRg9hNOccY06Lp4Byk9Sti2knjdfGhWQVAL-anVYTV0PqcljR8LqdHLDRguos8B2ucQIoKUf07UJ7zjkCfmT_fbPkZ1pJk02AeJ-r6085MBT349GXdLYM9bW4S4wkruD6_EtRYEq_R0rBbEGMFeishjAL0hLoipG607UwDKp6S5GY4q4wCND69lJzimGkzO-h2AkI.%22%2C%22expires%22%3A1574777542818%2C%22allSSL%22%3Atrue%2C%22persistent%22%3Afalse%2C%22created%22%3A1573567942818%2C%22culture%22%3A%22fr%22%2C%22region%22%3A%22WO%22%2C%22accountId%22%3A%220123456789ABCDEF%22%2C%22role%22%3A%22orgadmin%22%2C%22customBaseUrl%22%3A%22maps.esrifrance.fr%2Fportal%22%7D; APSW-query=%7B%22expires%22%3A1573585945143%7D Host: maps.esrifrance.fr Referer: https://maps.esrifrance.fr/portal/home/webmap/viewer.html?useExisting=1 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Mobile Safari/537.36 X-Requested-With: XMLHttpRequest https://wxs.ign.fr/n3bmjg0te91vxwdf5gwayf70/geoportail/r/wms?SERVICE=WMS&REQUEST=GetCapabilities&VERSION=1.3.0
WMS display worked in other versions before 10.7 but the behaviour with printing service was the same as ArcGIS Online #1
Here is the header of response from another test on a bug reported by Esri France support :
WMS is added to the webmap and we can display the service. The ArcGIS Enterprise 10.5 was used for those tests : GET https://wxs.ign.fr/gyt3i3cetodiz0smqughgvho/geoportail/r/wms?SERVICE=WMS&REQUEST=GetMap&FORMAT=image/png&TRANSPARENT=TRUE&STYLES=&VERSION=1.3.0&LAYERS=ORTHOIMAGERY.ORTHOPHOTOS.IRC&WIDTH=1168&HEIGHT=782&CRS=EPSG:3857&BBOX=365955.1075416435,5748132.487527829,455233.556578609,5807906.243646756 HTTP/1.1 Host: wxs.ign.fr User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: image/webp,/ Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Referer: https://bree.esrifrance.fr/portal/home/webmap/viewer.html?layers=e0ff0c0094484813b9a28728694178c1 Connection: keep-alive HTTP/1.1 200 OK Server: nginx Date: Fri, 21 Jun 2019 13:53:13 GMT Content-Type: image/png Content-Disposition: filename="image.png" wl-original-content-type: image/png Expires: Fri, 12 Jul 2019 13:53:13 GMT Cache-Control: max-age=1814400 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST Access-Control-Max-Age: 43200 Content-Length: 2440470 The proxy nginx of IGN accepte The referer, the GetMap query et & sent a PNG image. When you request an impression, the JSON map is sent to your print service, which is exposed on the same domain so there should be no problem to refer and yet the service Print can not request a GetMap on the IGN service. However, the PrintingTool Service can not get the map of the OGC IGN service, while the referer corresponds to the same domain, but its url has changed (archangel point instead of portal): POST https://bree.esrifrance.fr/arcgis/rest/services/Utilities/PrintingTools/GPServer/Export%20Web%20Map%20Task/execute HTTP/1.1 Host: bree.esrifrance.fr User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Referer: https://bree.esrifrance.fr/arcgis/rest/services/Utilities/PrintingTools/GPServer/Export%20Web%20Map%20Task/execute Content-Type: application/x-www-form-urlencoded Content-Length: 1296 Connection: keep-alive Cookie: ... If I restart the same GetMap request in a new tab of my browser in which a WebMap Portal tab with the displayed map is open, I will have this result: GET https://wxs.ign.fr/gyt3i3cetodiz0smqughgvho/geoportail/r/wms?SERVICE=WMS&REQUEST=GetMap&FORMAT=image/png&TRANSPARENT=TRUE&STYLES=&VERSION=1.3.0&LAYERS=ORTHOIMAGERY.ORTHOPHOTOS.IRC&WIDTH=1168&HEIGHT=782&CRS=EPSG:3857&BBOX=365955.1075416435,5748132.487527829,455233.556578609,5807906.243646756 HTTP/1.1 Host: wxs.ign.fr User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 21 Jun 2019 14:14:47 GMT Content-Type: application/xml wl-original-content-type: application/xml Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST Access-Control-Max-Age: 43200 Content-Length: 140 Wrong referer or wrong IP Adress or wrong User-Agent This time the IGN proxy nginx refuses the request for insufficient privilege, because the referer of the request has been lost! If I force the referer https://bree.esrifrance.fr in the request always since the same request GetMap from a new tab: GET https://wxs.ign.fr/gyt3i3cetodiz0smqughgvho/geoportail/r/wms?SERVICE=WMS&REQUEST=GetMap&FORMAT=image/png&TRANSPARENT=TRUE&STYLES=&VERSION=1.3.0&LAYERS=ORTHOIMAGERY.ORTHOPHOTOS.IRC&WIDTH=1168&HEIGHT=782&CRS=EPSG:3857&BBOX=365955.1075416435,5748132.487527829,455233.556578609,5807906.243646756 HTTP/1.1 Host: wxs.ign.fr User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Referer: https://bree.esrifrance.fr Pragma: no-cache Cache-Control: no-cache HTTP/1.1 200 OK Server: nginx Date: Fri, 21 Jun 2019 14:25:41 GMT Content-Type: image/png Content-Disposition: filename="image.png" wl-original-content-type: image/png Expires: Fri, 12 Jul 2019 14:25:41 GMT Cache-Control: max-age=1814400 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST Access-Control-Max-Age: 43200 Content-Length: 2440470 This time, the GetMap is processed without denied privilege access.
WMS is added to the webmap and we can display the service. The ArcGIS Enterprise 10.5 was used for those tests : GET https://wxs.ign.fr/gyt3i3cetodiz0smqughgvho/geoportail/r/wms?SERVICE=WMS&REQUEST=GetMap&FORMAT=image/png&TRANSPARENT=TRUE&STYLES=&VERSION=1.3.0&LAYERS=ORTHOIMAGERY.ORTHOPHOTOS.IRC&WIDTH=1168&HEIGHT=782&CRS=EPSG:3857&BBOX=365955.1075416435,5748132.487527829,455233.556578609,5807906.243646756 HTTP/1.1 Host: wxs.ign.fr User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: image/webp,/ Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Referer: https://bree.esrifrance.fr/portal/home/webmap/viewer.html?layers=e0ff0c0094484813b9a28728694178c1 Connection: keep-alive
HTTP/1.1 200 OK Server: nginx Date: Fri, 21 Jun 2019 13:53:13 GMT Content-Type: image/png Content-Disposition: filename="image.png" wl-original-content-type: image/png Expires: Fri, 12 Jul 2019 13:53:13 GMT Cache-Control: max-age=1814400 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST Access-Control-Max-Age: 43200 Content-Length: 2440470
The proxy nginx of IGN accepte The referer, the GetMap query et & sent a PNG image.
When you request an impression, the JSON map is sent to your print service, which is exposed on the same domain so there should be no problem to refer and yet the service Print can not request a GetMap on the IGN service. However, the PrintingTool Service can not get the map of the OGC IGN service, while the referer corresponds to the same domain, but its url has changed (archangel point instead of portal): POST https://bree.esrifrance.fr/arcgis/rest/services/Utilities/PrintingTools/GPServer/Export%20Web%20Map%20Task/execute HTTP/1.1 Host: bree.esrifrance.fr User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Referer: https://bree.esrifrance.fr/arcgis/rest/services/Utilities/PrintingTools/GPServer/Export%20Web%20Map%20Task/execute Content-Type: application/x-www-form-urlencoded Content-Length: 1296 Connection: keep-alive Cookie: ... If I restart the same GetMap request in a new tab of my browser in which a WebMap Portal tab with the displayed map is open, I will have this result: GET https://wxs.ign.fr/gyt3i3cetodiz0smqughgvho/geoportail/r/wms?SERVICE=WMS&REQUEST=GetMap&FORMAT=image/png&TRANSPARENT=TRUE&STYLES=&VERSION=1.3.0&LAYERS=ORTHOIMAGERY.ORTHOPHOTOS.IRC&WIDTH=1168&HEIGHT=782&CRS=EPSG:3857&BBOX=365955.1075416435,5748132.487527829,455233.556578609,5807906.243646756 HTTP/1.1 Host: wxs.ign.fr User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache
HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 21 Jun 2019 14:14:47 GMT Content-Type: application/xml wl-original-content-type: application/xml Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST Access-Control-Max-Age: 43200 Content-Length: 140
This time the IGN proxy nginx refuses the request for insufficient privilege, because the referer of the request has been lost!
If I force the referer https://bree.esrifrance.fr in the request always since the same request GetMap from a new tab: GET https://wxs.ign.fr/gyt3i3cetodiz0smqughgvho/geoportail/r/wms?SERVICE=WMS&REQUEST=GetMap&FORMAT=image/png&TRANSPARENT=TRUE&STYLES=&VERSION=1.3.0&LAYERS=ORTHOIMAGERY.ORTHOPHOTOS.IRC&WIDTH=1168&HEIGHT=782&CRS=EPSG:3857&BBOX=365955.1075416435,5748132.487527829,455233.556578609,5807906.243646756 HTTP/1.1 Host: wxs.ign.fr User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Referer: https://bree.esrifrance.fr Pragma: no-cache Cache-Control: no-cache
HTTP/1.1 200 OK Server: nginx Date: Fri, 21 Jun 2019 14:25:41 GMT Content-Type: image/png Content-Disposition: filename="image.png" wl-original-content-type: image/png Expires: Fri, 12 Jul 2019 14:25:41 GMT Cache-Control: max-age=1814400 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST Access-Control-Max-Age: 43200 Content-Length: 2440470
This time, the GetMap is processed without denied privilege access.
Data KEY : n3bmjg0te91vxwdf5gwayf70 Error when add a WMS in portal with esrifrance Referer.
Headers response :
_
WMS display worked in other versions before 10.7 but the behaviour with printing service was the same as ArcGIS Online #1
Here is the header of response from another test on a bug reported by Esri France support :