I am developing the back-end of an e-commerce system, which has customer and administrator type accounts. These two roles do not overlap, administrators are there to do the back office work, while customers do the shopping.
I would like to make the admin panel completely inaccessible to the public. If I were the only developer, I would probably opt for developing two applications mostly bound by the same database. My reasoning is based mostly on the principle of least privilege - if there is no need to make something public, then why would I? Also, this does not mean that I intend to implement weak customer security. I only believe that if I can get some extra safety for this specific scenario, then why not?
However, my colleague, who's doing the UI, is settled on creating a single app with a single login page for all users. I guess it is not really important, and I am not keen of arguments. And yet I still would like to apply the aforementioned principle to make it somewhat impossible to login as an administrator from the public.
I was thinking:
- Have a main domain mystore.com and a subdomain admin.mystore.com both pointing to the same backend.
- Only allow access to the subdomain via a VPN connection (I guess I would perform the necessary checks in the backend application code).
- If the login request is coming from the admin subdomain, I would match the credentials agains the admins table. Otherwise I would check the customers table.
In my eyes, an administrator is not a customer, and since they don't really share any details aside from the login credentials and full name, I would keep these two separate.
Questions:
- Overall, does my reasoning make any sense, how bad is this idea and am I just wasting my time?
- If it's feasible, is only allowing access to a subdomian via a VPN possible? Sadly I don't know much about setting VPNs up either.
- If not feasible, what would be your advice? Would you have one site, one login page, one common table and exactly the same level of security for both the admins and customers?
More details
I probably didn't make my limitation very clear.
Let's say that I already have a working UI single-page app, which I won't be able to modify for a number of reasons.
This UI code has a login page, which calls a login endpoint somewhere, which then returns a token. Based on this token the page redirects the user to either the admin or the customer dashboard.
The administrator resources in the back-end are, of course, protected by user roles, so it's not a huge problem. Yet still, in addition to that I want to limit the possibility of logging in as an admin from the public Internet as much as possible.
I have complete freedom over the server and no control over the UI. I was thinking about separating admins and customers into different tables and routing the login request to match against the respective table based on how the endpoint is being accessed. If I can't achieve what I want this way, then it seems like any other change would require an accompanying UI change.
yourstore.com
andadmin.yourstore.com
then don't handle the connection limits to admin in your code - handle it in the server config. What I do to access things like phpmyadmin and my poorly-coded-but-works email user control panel is have a virtualhost that only listens on the loop back. I ssh in and tunnel a connection from my machine to the remote machine's loopback. Works great, no code to worry about.