topic Securing AGS output, cache, and jobs folders in ArcGIS REST APIs and Services Questions

Securing AGS output, cache, and jobs folders

NathanielWingfield — Thu, 14 Jul 2011 19:53:56 GMT

ArcGIS Server (for .NET) generates images, etc. in arcgisoutput, arcgiscache, and arcgisjobs folders. Can the AGS security system (specifically, token-based) be used to secure these folders in the same manner as the REST API? Or do they require a separate strategy? I've pored over the documentation but have found nothing specific to this aspect of AGS security.

Re: Securing AGS output, cache, and jobs folders

RogerBannister — Wed, 10 Aug 2011 18:11:40 GMT

I'm curious if you ever found an answer. The best that I could do was try to persuade myself that asynchronous job output had a timer on it, the directory doesn't allow listing, and the job GUID would be very difficult to guess (for a human at least). Certainly there's a better answer out there... you spend all this effort setting up token-based security for the services, it seems silly that the output isn't similarly locked down.

Re: Securing AGS output, cache, and jobs folders

NathanielWingfield — Tue, 06 Sep 2011 17:02:38 GMT

I'm curious if you ever found an answer. The best that I could do was try to persuade myself that asynchronous job output had a timer on it, the directory doesn't allow listing, and the job GUID would be very difficult to guess (for a human at least). Certainly there's a better answer out there... you spend all this effort setting up token-based security for the services, it seems silly that the output isn't similarly locked down.

http://gis.stackexchange.com/questions/12207/securing-ags-output-cache-and-jobs-folders

Re: Securing AGS output, cache, and jobs folders

JonBurgoyne1 — Tue, 25 Sep 2018 18:55:30 GMT

https://developers.arcgis.com/rest/enterprise-administration/server/securityconfig.htm

(Virtual Directories Security Enabled)—A boolean that indicates if the server's virtual directories are secured and require authentication.

If true, accessing the content in the arcgisoutput, arcgisjobs, and arcgisinput directories over HTTP will require user authentication. This will negatively impact performance.