GeoNames Forum

Hi, I'm interested in using the commercial services in an environment where it would be trivial for a malicious user to discover the identifying token as passed in the HTTP GET request via the Java client library... is it possible to access the commercial service in such a way such that the request is signed with a private key, rather than exposing a token to the world? Thanks!

If you are using accessing the service from a fix set of ip addresses then you can restrict access to those. Private keys are not supported.

Best

Marc

I'm not, unfortunately. (My use case is an Android application for which the free servers are too slow / down too often.) Do you have another suggestion, or is there any chance of this being implemented for commercial use? (I'd be willing to implement it even... should be only a few lines of code assuming a DSA library is available.)

you could use the secure server and send the token as post parameter. Then you are protected against sniffers.

Marc

Ah! Beautiful idea, thank you!

Hi, could anyone show the example of how can I use the secure server and send the token as post parameter? Thanks in advance!

The secure server is only available for commercial users and the implementation depends on the programming language you are using. Consult the documentation of your programming language to see how to implement a post request.

Best

Marc