Feature request OAPIF: support for API-keys via query for API implementing OGC API - Features

[heidivanparys]

Expected behavior and requested behavior.

When adding a service that implements OGC API - Features and that needs an API-key for implementation, the api-key is stripped of the URL when the driver looks for a specific collection, resulting in a 403 error when that collection is secured. It would be great if the api-key parameter would not be stripped off.

Steps to reproduce the problem.

OGC API - Features service with an API that could look like this (api-key used for all the paths that go deeper than /collections).

(see also http://spec.openapis.org/oas/v3.0.3#securitySchemeObject and http://spec.openapis.org/oas/v3.0.3#non-oauth2-security-requirement)

Even when adding ?api-key=myApiKey to the landing page URL, trying to add the features of a collection like that results in

WARNING Download of collection description failed: Error transferring https://link.to.com/v2/data/collections/collectionId - server replied: Forbidden

Operating system

N/A

GDAL version and provenance

3.2.0

Tested via QGIS:

QGIS version	3.15.0-Master	QGIS code revision	0bd81d27c6
Compiled against Qt	5.11.2	Running against Qt	5.11.2
Compiled against GDAL/OGR	3.2.0dev	Running against GDAL/OGR	3.2.0dev
Compiled against GEOS	3.8.1-CAPI-1.13.3	Running against GEOS	3.8.1-CAPI-1.13.3
Compiled against SQLite	3.29.0	Running against SQLite	3.29.0
PostgreSQL Client Version	11.5	SpatiaLite Version	4.3.0
QWT Version	6.1.3	QScintilla2 Version	2.10.8
Compiled against PROJ	7.2.0	Running against PROJ	Rel. 7.2.0, November 1st, 2020
OS Version	Windows 10 (10.0)	This copy of QGIS writes debugging output.
Active python plugins	db_manager; MetaSearch; processing

[rouault]

Actually I believe this should already work per aad2cbc
This would need the exact URL to reproduce the issue. (you can email me at even.rouault at spatialys.com)

[rouault]

With the service URL provided, I can confirm this is not a GDAL issue, but a QGIS issue. GDAL works fine (with a minor caveat addressed in commit 0949a99), but QGIS doesn't indeed. QGIS doesn't use the GDAL OAPIF provider, but has its own code. Could you reopen this issue on https://github.com/qgis/QGIS instead ?

[heidivanparys]

@rouault Thanks for looking at this. I opened a new issue: qgis/QGIS#38436.