GeoServer 2.23.4 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a maintenance release of GeoServer providing existing installations with minor updates and bug fixes. GeoServer 2.23.4 is made in conjunction with GeoTools 29.4, and GeoWebCache 1.23.3.

Thanks to Peter Smythe (AfriGIS) for making this release.

Security Considerations

This release addresses security vulnerabilities and is considered an essential update for production systems.

• CVE-2023-51444 Arbitrary file upload vulnerability in REST Coverage Store API (High).
• CVE-2023-41877 GeoServer log file path traversal vulnerability (High).
• CVE-2024-23821 Stored Cross-Site Scripting (XSS) vulnerability in GWC Demos Page (Moderate).
• CVE-2024-23819 Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page (Moderate).
• CVE-2024-23642 Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer (Moderate).
• CVE-2023-51445 Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API (Moderate).

See project security policy for more information on how security vulnerabilities are managed.

Release notes

Improvement:

• GEOS-11152 Improve handling special characters in the Simple SVG Renderer
• GEOS-11154 Improve handling special characters in the MapML HTML Page
• GEOS-11176 Add validation to file wrapper resource paths
• GEOS-11188 Let DownloadProcess handle download requests whose pixel size is larger than integer limits
• GEOS-11189 Add an option to throw a service exception when nearest match “allowed interval” is exceeded
• GEOS-11193 Add an option to throw an exception when the time nearest match does not fall within search limits
• GEOS-11219 Upgrade mail and activation libraries

Bug:

• GEOS-9757 Return a service exception when client provided WMS dimensions are not a match
• GEOS-11074 GeoFence may not load property file at boot
• GEOS-11184 ncwms module has a compile dependency on gs-web-core test jar
• GEOS-11190 GeoFence: align log4j2 deps
• GEOS-11196 NPE in VectorDownload if ROI not defined
• GEOS-11200 GetFeatureInfo can fail on rendering transformations that generate a different raster
• GEOS-11203 WMS GetFeatureInfo bad WKT exception for label-geometry
• GEOS-11206 Throw nearest match mismatch exceptions only for WMS
• GEOS-11223 Layer not visible in preview/capabilities if security closes the workspace, but allows access to the layer
• GEOS-11224 Platform independent binary doesn’t start properly with default data directory

For the complete list see 2.23.4 release notes.

Community Updates

Community module development:

• GEOS-11209 Open ID Connect Proof Key of Code Exchange (PKCE)
• GEOS-11212 OIDC accessToken verification using only JWKs URI

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you please contact the module developer to offer assistance.

About GeoServer 2.23 Series

Additional information on GeoServer 2.23 series:

• GeoServer 2.23 User Manual
• Drop Java 8
• GUI CSS Cleanup
• Add the possibility to use fixed values in Capabilities for Dimension metadata
• State of GeoServer 2.23
• GeoServer Feature Frenzy 2023
• GeoServer used in fun and interesting ways
• GeoServer Orientation

Release notes: ( 2.23.4 | 2.23.3 | 2.23.2 | 2.23.1 | 2.23.0 | 2.23-RC1 )

GeoSpatial Techno is a startup focused on geospatial information that is providing e-learning courses to enhance the knowledge of geospatial information users, students, and other startups. The main approach of this startup is providing quality, valid specialized training in the field of geospatial information.

( YouTube | LinkedIn | Facebook | Reddit | X )

GeoServer installation methods: “Windows Installer” and “Web Archive”

GeoServer installation methods: “Windows Installer” and “Web Archive” In this session, we will talk about how to install GeoServer software by two common methods in Windows. If you want to access the complete tutorial, simply click on the link.

Introduction

GeoServer can be installed on different operating systems, since it’s a Java based application. You can run it on any kind of operating system for which exists a Java virtual machine. GeoServer’s speed depends a lot on the chosen Java Runtime Environment (JRE). The latest versions of GeoServer are tested with both OracleJRE and OpenJDK. These versions are:

• Java 17 for GeoServer 2.23 and above
• Java 11 for GeoServer 2.15 and above
• Java 8 for GeoServer 2.9 to GeoServer 2.22
• Java 7 for GeoServer 2.6 to GeoServer 2.8
• Java 6 for GeoServer 2.3 to GeoServer 2.5
• Java 5 for GeoServer 2.2 and earlier

But remember that the older versions are unsupported and won’t receive fixes nor security updates, and contain well-known security vulnerabilities that have not been patched, so use at own risk. That is true for both GeoServer and Java itself.

There are many ways to install GeoServer on your system. This tutorial will cover the two most commonly used installation methods on Windows.

• Windows Installer
• Web Archive

Windows installer

The Windows installer provides an easy way to set up GeoServer on your system, as it requires no configuration files to be edited or command line settings.

Installation

• GeoServer requires a Java environment (JRE) to be installed on your system, available from Adoptium for Windows Installer, or provided by your OS distribution. For more information, please refer to this link: https://docs.geoserver.org/latest/en/user/installation/index.html#installation

Consider the operating system architecture and memory requirements when selecting a JRE installer. 32-bit Java version is restricted to 2 GB memory, while the 64-bit version is recommended for optimal server memory. Utilizing JAI with the 32-bit JRE can enhance performance for WMS output generation and raster operations.

• Install JRE by following the default settings and successfully complete the installation.
• Navigate to the GeoServer.org and download the desired version of GeoServer.
• Launch the GeoServer installer and agree to the license.
• Enter the path to the JRE installation and proceed with the installation. The installer will attempt to automatically populate this box with a JRE if it is found, but otherwise you will have to enter this path manually.
• Provide necessary details like the GeoServer data directory, administration credentials, and port configuration.
• Review the selections, install GeoServer, and start it either manually or as a service.
• Finally, navigate to localhost:8080/geoserver (or wherever you installed GeoServer) to access the GeoServer Web administration interface.

Uninstallation

GeoServer can be uninstalled in two ways:

• By running the uninstall.exe file in the directory where GeoServer was installed
• By standard Windows program removal

Web Archive

GeoServer is packaged as a web-archive (WAR) for use with an application server such as Apache Tomcat or Jetty. It has been mostly tested using Tomcat, and so is the recommended application server. There are reasons for installing it such as it is widely used, well-documented, and relatively simple to configure. GeoServer requires a newer version of Tomcat (7.0.65 or later) that implements Servlet 3 and annotation processing. Other application servers have been known to work, but are not guaranteed.

Installation

• Make sure you have a JRE installed on your system, then download Apache Tomcat from its website(https://tomcat.apache.org). For the Windows installation package, scroll down and choose the 32bit/64bit Windows Service Installer option.
• Configure Tomcat by selecting components, setting up a username and password, and specifying memory settings. So, before start the Tomcat service, you have to configure the memory settings that will use for Java VM. To do it, open the Tomcat9w from the bin folder, then click on the Java tab. This tab allows for configuration of memory settings, including initial and maximum memory pool sizes. Recommended values are 512MB for the initial memory pool and 1024MB for the maximum memory pool.
• Start Tomcat service and verify its functionality, then navigate to localhost:8080, and get the Tomcat9 web page.
• Navigate to the GeoServer.org and Download page. Select Web Archive on the download page from the version of GeoServer that you wish to download.
• Deploy the GeoServer web archive as you would normally. Often, all that is necessary is to copy the GeoServer.war file to the Tomcat’s webapps directory, then the application will be deployed automatically.
• Now to access the Web administration interface, open a browser and navigate to localhost:8080 and press Manager App button. Enter the username and password of apache tomcat. Click on the start button for the GeoServer. Once it has started, click the GeoServer link. This will take you to the GeoServer web page.

Uninstallation

Stop the container application. Remove the GeoServer webapp from the container application’s webapps directory. This will usually include the GeoServer.war file as well as a GeoServer directory.

Difference between GEOSERVER.war and GEOSERVER.exe?

• The ‘GeoServer.exe’ NSIS installer registers GeoServer as a Windows Service, which uses the Jetty application server to run GeoServer. The ‘GeoServer.war’ is a platform independent web-archive package to be deployed in your own application server (we recommend Apache Tomcat). Using the ‘GeoServer.exe’ installer is a reliable way to setup GeoServer as a windows background service. The downside is the included Jetty application server is managed using text files (jetty.ini) once installed.
• Use of ‘GeoServer.war’ web-archive is provided to install into your own application server (we recommend Apache Tomcat as the market leader, with excellent documentation and integration options). A single application server may support several web application allowing GeoServer to be run alongside your own java web application.

GeoServer 2.24.1 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a stable release of GeoServer recommended for production use. GeoServer 2.24.1 is made in conjunction with GeoTools 30.1, and GeoWebCache 1.24.1.

Thanks to Jody Garnett (GeoCat) for making this release.

Security Considerations

This release addresses security vulnerabilities and is considered an essential upgrade for production systems.

• CVE-2023-51444 Arbitrary file upload vulnerability in REST Coverage Store API (High).
• CVE-2024-23819 Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page (Moderate).
• CVE-2024-23640 Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format (Moderate).
• CVE-2024-23821 Stored Cross-Site Scripting (XSS) vulnerability in GWC Demos Page (Moderate).
• CVE-2024-23643 Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form (Moderate).
• CVE-2024-23642 Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer (Moderate).

See project security policy for more information on how security vulnerabilities are managed.

Release notes

Improvement:

• GEOS-11152 Improve handling special characters in the Simple SVG Renderer
• GEOS-11153 Improve handling special characters in the WMS OpenLayers Format
• GEOS-11154 Improve handling special characters in the MapML HTML Page
• GEOS-11155 Add the X-Content-Type-Options header
• GEOS-11173 Default to using HttpOnly session cookies
• GEOS-11176 Add validation to file wrapper resource paths
• GEOS-11188 Let DownloadProcess handle download requests whose pixel size is larger than integer limits
• GEOS-11189 Add an option to throw a service exception when nearest match “allowed interval” is exceeded
• GEOS-11193 Add an option to throw an exception when the time nearest match does not fall within search limits

Bug:

• GEOS-11074 GeoFence may not load property file at boot
• GEOS-11166 OGC API Maps HTML representation fail without datetime parameter
• GEOS-11184 ncwms module has a compile dependency on gs-web-core test jar
• GEOS-11190 GeoFence: align log4j2 deps
• GEOS-11196 NPE in VectorDownload if ROI not defined
• GEOS-11200 GetFeatureInfo can fail on rendering transformations that generate a different raster
• GEOS-11203 WMS GetFeatureInfo bad WKT exception for label-geometry
• GEOS-11206 Throw nearest match mismatch exceptions only for WMS

For the complete list see 2.24.1 release notes.

Community Module Updates

OAuth2 OpenID-Connect improvements

Two improvements have been made to the community module for OAuth2 OpenID-Connect authentication:

• GEOS-11209 Open ID Connect Proof Key of Code Exchange (PKCE)
• GEOS-11212 OIDC accessToken verification using only JWKs URI

In addition the module includes an OIDC_LOGGING profile and updated documentation covering new settings and troubleshooting guidance.

Thanks Jody Garnett for these improvements on behalf of GeoBeyond.

note: Over the course of 2024 the OAuth2 plugins will need to be rewritten for spring-framework 6. Interested parties are encouraged to reach out to geoserver-devel email list; ideally we would like to see this functionality implemented and included as part of GeoServer.

About GeoServer 2.24 Series

Additional information on GeoServer 2.24 series:

• GeoServer 2.24 User Manual
• State of GeoServer 2.24 (foss4g-na presentation)
• Control remote HTTP requests sent by GeoTools/GeoServer
• Multiple CRS authority support, planetary CRS
• Extensive GeoServer Printing improvements
• Upgraded security policy

Release notes: ( 2.24.1 | 2.24.0 | 2.24-RC )

GeoServer is an Open Source Geospatial Foundation project supported by a mix of volunteer and service provider activity. We reply on sponsorship to fund activities beyond the reach of individual contributors.

GeoServer 2.23.3 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a maintenance release of GeoServer providing existing installations with minor updates and bug fixes. GeoServer 2.23.3 is made in conjunction with GeoTools 29.3, and GeoWebCache 1.23.2.

Thanks to Peter Smythe (AfriGIS) for making this release.

Security Considerations

This release addresses security vulnerabilities and is considered an essential upgrade for production systems.

• CVE-2024-23818 Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format (Moderate).
• CVE-2024-23640 Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher (Moderate).
• CVE-2023-51445 Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API (Moderate).

This release includes security patches from projects that GeoServer depends on.

• GEOS-11030 Update jetty-server to 9.4.51.v20230217

See project security policy for more information on how security vulnerabilities are managed.

Also, another reminder of the URL check security setting that was introduced in version 2.22.4 and version 2.23.2 (but turned off by default). The latest GeoServer 2.24.0 release has this setting enabled by default. If you are not yet in a position to upgrade to 2.24.0 you are encouraged to enable this recommended setting.

Release notes

New Feature:

• GEOS-11000 WPS process to provide elevation profile for a linestring

Improvement:

• GEOS-10856 geoserver monitor plugin - scaling troubles
• GEOS-11081 Add option to disable GetFeatureInfo transforming raster layers
• GEOS-11087 Fix IsolatedCatalogFacade unnecessary performance overhead
• GEOS-11089 Performance penalty adding namespaces while loading catalog
• GEOS-11090 Use Catalog streaming API in WorkspacePage
• GEOS-11099 ElasticSearch DataStore Documentation Update for RESPONSE_BUFFER_LIMIT
• GEOS-11100 Add opacity parameter to the layer definitions in WPS-Download download maps
• GEOS-11102 Allow configuration of the CSV date format
• GEOS-11114 Improve extensibility in Pre-Authentication scenarios
• GEOS-11116 GetMap/GetFeatureInfo with groups and view params can with mismatched layers/params
• GEOS-11120 Create aggregates filterFunction in OSEO to support STAC Datacube extension implementation
• GEOS-11130 Sort parent role dropdown in Add a new role
• GEOS-11142 Add mime type mapping for yaml files
• GEOS-11148 Update response headers for the Resources REST API
• GEOS-11149 Update response headers for the Style Publisher
• GEOS-11153 Improve handling special characters in the WMS OpenLayers Format
• GEOS-11155 Add the X-Content-Type-Options header

Bug:

• GEOS-10452 Use of Active Directory authorisation seems broken since 2.15.2 (LDAP still works)
• GEOS-11032 Unlucky init order with GeoWebCacheExtension gwcFacade before DiskQuotaMonitor
• GEOS-11138 Jetty unable to start cvc-elt.1.a / org.xml.sax.SAXParseException
• GEOS-11140 WPS download can leak image references in the RasterCleaner
• GEOS-11145 The GUI “wait spinner” is not visible any longer
• GEOS-11166 OGC API Maps HTML representation fail without datetime parameter

Task:

• GEOS-10248 WPSInitializer NPE failure during GeoServer reload
• GEOS-11030 Update jetty-server to 9.4.51.v20230217
• GEOS-11084 Update text field css styling to look visually distinct
• GEOS-11091 Upgrade spring-security to 5.7.10
• GEOS-11092 acme-ldap.jar is compiled with Java 8
• GEOS-11094 Bump org.hsqldb:hsqldb:2.7.1 to 2.7.2
• GEOS-11124 Update json dependency to 20230227 in geowebcache-rest
• GEOS-11141 production consideration for logging configuration hardening

For the complete list see 2.23.3 release notes.

About GeoServer 2.23 Series

Additional information on GeoServer 2.23 series:

• GeoServer 2.23 User Manual
• Drop Java 8
• GUI CSS Cleanup
• Add the possibility to use fixed values in Capabilities for Dimension metadata
• State of GeoServer 2.23
• GeoServer Feature Frenzy 2023
• GeoServer used in fun and interesting ways
• GeoServer Orientation

Release notes: ( 2.23.3 | 2.23.2 | 2.23.1 | 2.23.0 | 2.23-RC1 )

This is a community blog post introducing Geospatial Techno, along with a sample of one of their GeoServer training videos.

GeoSpatial Techno is a startup focused on geospatial information that is providing e-learning courses to enhance the knowledge of geospatial information users, students, and other startups. The main approach of this startup is providing quality, valid specialized training in the field of geospatial information.

( YouTube | LinkedIn | Reddit | Facebook | X )

Getting to know OGC web services and GeoServer software

The course guides you in using GeoServer software to create geospatial web services, styles and publish them step by step simply and practically. Now, before delving into OGC web services, it is important to familiarize yourself with the various types of services.

In this session, we introduced you to the basics of the OGC web services and GeoServer software. If you want to access the complete tutorial, simply click on the link.

I would highly appreciate it if you could subscribe to my channel and share it with your friends to help spread this tutorial. By subscribing, you will gain complete access to the training video, which will enable you to enhance your skills. Moreover, sharing it with your friends guarantees that they can also benefit from this valuable resource. Thank you for your support.

What is Service?

A collection of operations, accessible through an interface, that allows a user to invoke a behavior of value to the user.

What are Web Services?

Web services are internet-based applications that can perform a wide range of functions, from simple tasks to complex business processes.

What are GeoSpatial Web Services?

GeoSpatial web services are online platforms that offer access to and analyze geographical information. They aim to overcome the lack of compatibility between different geospatial systems.

Why do you need standard web services?

Standard web services provide a common platform for communication between modern-day business applications that use different programming languages. This enables convenient interaction regardless of development language.

What is OGC?

The Open Geospatial Consortium (OGC) is an international organization that promotes the use of open standards to make geospatial information and services to be “FAIR”, which stands for Findable, Accessible, Interoperable, and Reusable. This goal applies to various areas such as data sharing, data processing, sensor web, and the Internet of Things.

What are OGC Web Services?

OGC Web Services (OWS) are a set of standards that allow for seamless integration of various online geoprocessing and location services. With OWS, users can access and utilize services such as the Web Map Service (WMS), Web Feature Service (WFS), Web Coverage Service (WCS), and Web Map Tile Service (WMTS).

WMS enables users to retrieve and obtain detailed information on maps of geospatial data. WFS allows for data manipulation operations on geographic features, including querying, creating, modifying, and deleting features. WCS provides access to raster datasets like elevation models and remote sensing imagery. WMTS serves pre-rendered or computed map tiles over the internet.

These services provide an interoperable framework for accessing, integrating, analyzing, and visualizing online geodata sources, sensor-derived information, and geoprocessing capabilities.

What is GeoServer?

GeoServer is a Java-based server that allows users to view and edit geospatial data. Using open standards set forth by the Open Geospatial Consortium (OGC), GeoServer allows for great flexibility in map creation and data sharing.

Open and Share Your Spatial Data

GeoServer is a powerful open-source tool for displaying spatial information through maps in various formats. The tool integrates OpenLayers, a free mapping library, for easy and quick map generation. Moreover, It supports standards like WMS, WFS, WCS, and WMTS, enabling data sharing, editing, and easy integration with web and mobile applications. With modular functionality and extensions, GeoServer offers extensive processing options. For example, the Web Processing Service (WPS) extension provides a wide range of processing options, and users can even create their extensions.

Use Free and Open Source Software

GeoServer is a free and open-source software that brings down the financial barrier to using GIS products. It is released every six months with new features, bug fixes, and improvements, providing a quick turnaround time. This transparent process often leads to faster advancements compared to closed software solutions. By using GeoServer, organizations can avoid software lock-in and save money on support contracts in the future.

Integrate With Mapping APIs

GeoServer is a versatile software that can integrate with popular mapping applications like Google Maps and Microsoft Bing Maps. It can also connect with traditional GIS architectures such as ESRI ArcGIS. OpenLayers and Leaflet are recommended as complementary tools to GeoServer for web mapping needs.

Join the Community

GeoServer has an active global community of users and developers, offering support through email lists. The software has a fixed release cycle and public issue tracker, ensuring transparency and regular updates. Commercial support is also available. Overall, using GeoServer means being part of a supportive community.