1

I am developing the back-end of an e-commerce system, which has customer and administrator type accounts. These two roles do not overlap, administrators are there to do the back office work, while customers do the shopping.

I would like to make the admin panel completely inaccessible to the public. If I were the only developer, I would probably opt for developing two applications mostly bound by the same database. My reasoning is based mostly on the principle of least privilege - if there is no need to make something public, then why would I? Also, this does not mean that I intend to implement weak customer security. I only believe that if I can get some extra safety for this specific scenario, then why not?

However, my colleague, who's doing the UI, is settled on creating a single app with a single login page for all users. I guess it is not really important, and I am not keen of arguments. And yet I still would like to apply the aforementioned principle to make it somewhat impossible to login as an administrator from the public.

I was thinking:

  1. Have a main domain mystore.com and a subdomain admin.mystore.com both pointing to the same backend.
  2. Only allow access to the subdomain via a VPN connection (I guess I would perform the necessary checks in the backend application code).
  3. If the login request is coming from the admin subdomain, I would match the credentials agains the admins table. Otherwise I would check the customers table.

In my eyes, an administrator is not a customer, and since they don't really share any details aside from the login credentials and full name, I would keep these two separate.

Questions:

  1. Overall, does my reasoning make any sense, how bad is this idea and am I just wasting my time?
  2. If it's feasible, is only allowing access to a subdomian via a VPN possible? Sadly I don't know much about setting VPNs up either.
  3. If not feasible, what would be your advice? Would you have one site, one login page, one common table and exactly the same level of security for both the admins and customers?

More details

I probably didn't make my limitation very clear.

Let's say that I already have a working UI single-page app, which I won't be able to modify for a number of reasons.

This UI code has a login page, which calls a login endpoint somewhere, which then returns a token. Based on this token the page redirects the user to either the admin or the customer dashboard.

The administrator resources in the back-end are, of course, protected by user roles, so it's not a huge problem. Yet still, in addition to that I want to limit the possibility of logging in as an admin from the public Internet as much as possible.

I have complete freedom over the server and no control over the UI. I was thinking about separating admins and customers into different tables and routing the login request to match against the respective table based on how the endpoint is being accessed. If I can't achieve what I want this way, then it seems like any other change would require an accompanying UI change.

| improve this question | |
  • 1
    If you are separating into yourstore.com and admin.yourstore.com then don't handle the connection limits to admin in your code - handle it in the server config. What I do to access things like phpmyadmin and my poorly-coded-but-works email user control panel is have a virtualhost that only listens on the loop back. I ssh in and tunnel a connection from my machine to the remote machine's loopback. Works great, no code to worry about. – ivanivan Sep 14 '18 at 13:05
  • Yes, this would also work, but also in a different scenario. I have clarified the limitation that I am facing in the question. Typing it out in words made me realize how dumb the situation/question really are though... If your answer still holds, then I probably didn't understand it fully. – Avius Sep 14 '18 at 14:31
0
  1. Overall, does my reasoning make any sense, how bad is this idea and am I just wasting my time?

Honestly, I think you're wasting your time. If you can't isolate the admin features into a separate application then you run the risk of an attacker elevating their privileges to admin level within the shared app.

An IP check is trivial to circumvent for a motivated attacker.

  1. If it's feasible, is only allowing access to a subdomian via a VPN possible? Sadly I don't know much about setting VPNs up either.

I'm sure it's possible, but again, why go through the trouble of VPN configuration if it won't solve your root issue?

  1. If not feasible, what would be your advice? Would you have one site, one login page, one common table and exactly the same level of security for both the admins and customers?

My advice? Separate the applications and secure the admin site using network segregation (VPN, whatever).

If there are reasons preventing you from doing this, then you simply need to acknowledge that the admin site is not as secure as you'd like.

| improve this answer | |
  • You are right, as long as the app is the same, there is always some possibility of rights elevation, even if I don't see it. That is why I wanted to implement all of these (at least in my mind the IP check went with some extra token or whatever, had not figured that out yet). I'll take your advice and skip this, since I don't see myself responsible, and my proposition has been laid out to those who are. – Avius Sep 14 '18 at 15:05
0

  1. You are right. Having the same site do both things is an unnecessary security risk. Plus it makes your life hard having to worry about both types of user all the time.

  2. No, if its the same site then its the same site. It doesn't really matter what url you came in on

  3. My advice would be as you say, completely separate the admin functionality from the shopping site. In fact you will probably want more than one admin site, one for content, one for stock, one for reporting etc etc

| improve this answer | |
  • I understand how frustrating it is to give an answer and then have the OP say "nope", can't go with the optimal solution. Sadly, I am not in a position to implement a full separation, so I only want to do as much as I can from my side, given the limitation. I also understand that generally a VPN provides access to a network, not a resource. But couldn't I perform an IP check in the application code? I would only have a few admins, so if I set up the VPN with a static IP and then check if host == admin.mystore.com and ip == vpnIP, proceed with admin login... Is that bad? – Avius Sep 14 '18 at 8:48
  • no problem, I'd love to be able to give you a clever work around, but unfortunately I don't know of any :( – Ewan Sep 14 '18 at 8:49
  • Accidentally posted the comment too early. Made an amendment now, could you take a look? Also, thank you for the answer, I particularly appreciate the support on the separation idea, makes me feel less incompetent, lol. – Avius Sep 14 '18 at 9:42
  • 1
    yes you can put extra checks in for the admin user, but i assume you existing permissions system already distinguishes between the user types. an extra ip check might work, but your not significantly improving the solution – Ewan Sep 14 '18 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.