Hi All:
The WMS endpoints in our TDS were all working fine, until based on a security
audit we had to add some things to our Apache configuration. So for example we
have to completely block displaying the contents of directories, so "Options"
can not have "Indexes" or "Multiview" and also we need things like:
<IfModule mod_headers.c>
Header set X-Content-Type-Options nosniff
Header set X-XSS-Protection "1; mode=block"
</IfModule>
With this changes all of the other services work fine, but the WMS endpoints
(all that I have tried), fail. These security changes to Apache are the only
things that have changed - none of the TDS related files or settings have been
altered, see for example:
http://oceanwatch.pfeg.noaa.gov/thredds/Satellite/MUR41/catalog.html?dataset=satellite/MUR41/ssta/1day
http://oceanwatch.pfeg.noaa.gov/thredds/Satellite/MUR41/catalog.html?dataset=satellite/MUR41/ssta/mday
Clearly there is some interaction here between the Apache server and the WMS
service, but is beyond what I know.
Thanks for any help.
-Roy
**********************
"The contents of this message do not reflect any position of the U.S.
Government or NOAA."
**********************
Roy Mendelssohn
Supervisory Operations Research Analyst
NOAA/NMFS
Environmental Research Division
Southwest Fisheries Science Center
***Note new street address***
110 McAllister Way
Santa Cruz, CA 95060
Phone: (831)-420-3666
Fax: (831) 420-3980
e-mail: Roy.Mendelssohn@xxxxxxxx www: http://www.pfeg.noaa.gov/
"Old age and treachery will overcome youth and skill."
"From those who have been given much, much will be expected"
"the arc of the moral universe is long, but it bends toward justice" -MLK Jr.
