If I have a system that consists of
- an application server which responds to requests made only from the web server.
- a web server that responds to client requests over the internet.
Is it necessary if I want to keep my data 'safe' to implement some sort of authentication between the two?
Ideally I would have these two physical machines connected in such a way that the application server is not connected directly to the public internet, only to the web server and then IP restrict requests so the application server only responds to the web server.
In reality each will probably be hosted on a VPS, so what's connected to what else is a null issue.
Is IP restricting requests considered safe enough in this case or do I need something stronger? If so, will a simple username/password combination be safe enough?