We are using geoserver (2.3) to serve WMS map tiles generated from mapping data we licenced. We use leaflet on the client side to show the map (part of a ruby on rails site running on heroku). Because of the licence of the mapping data, we should not allow anybody to use these map tiles, it should be only accessible by our users when they are using the map on our website.
Is there any way to avoid somebody just taking the WMS URL from our javascript code and using it on another site? Or bulk downloading all the map tiles?
We can configure the geoserver to require username/password or certificate, but then we would need to expose it to the client side.
Thanks!