4

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration of the same. Now, I'm aware that there are third party tools that can make a lot of things easier but some management functionality and information is app specific, and my admin dashboard aims to cover those.

Since I have only vague ideas about how to develop and where to hide such a dashboard, I'm wondering how large sites — Twitter, Instagram — do it. I have a hunch that they hide their admin dashboards from the public inside either a Virtual Private Network or a Virtual Private Cloud with private IP addresses.

  • Is this assumption correct?

  • If so, how is the source code for the admin site handled in relation to the source code for the web app itself — is the source code for the two sites handled separately or together, and does it get special treatment?

Another approach I'm familiar with is hosting the admin dashboard and the web app together at the same domain. Something like admin.mydomain.com or mydomain.com/admin This is however undesirable to me, as it'll require robots.txt entries that pinpoint exactly where the admin site can be found. I'd like the location of the admin site to not be known at all.

So what other options are available that I'm unaware of?

UPDATE: That I want to hide the admin site does not mean that I intend to be lax with auth. Strong passwords and MFA will be required on the admin site, whether it's hidden or not.

Improve this question
2
  • I'm wondering why you have this goal "I'd like the location of the admin site to not be known at all."? Your admin site should be secure even if everyone knows it's location.
    – Neil Smithline
    Mar 8, 2016 at 19:25
  • Of course. The usual checks — passwords, MFA — will all be required on the admin site. But I'll still want it hidden for extra safety and peace of mind.
    – Zero
    Mar 8, 2016 at 19:32

2 Answers 2

Reset to default
2

Congrats on finishing an application.

Suggestions:

Hiding vs. Securing
Don't rely on hiding the dashboard. Instead rely on controlling access with roles and an IP address whitelist.

Role Based Access Control
What happens often is that an administrative page is blocked by access control, but the URL that the page submits to is not blocked, so administrative commands can be made by those who are not admins if they know the back-end URL. A centralized, role-based access control framework in your application is best for this and most web application frameworks have one. It is easier to configure all this if the admin pages are in a different domain or in a directory like mydomain.com/admin.

Separation of concerns:
Anything that is not the primary purpose of your new application will be better handled by a tool made for that purpose. For example, "monitoring" sounds like something a centralized log management software is better for. Maybe your organization already has one of these.

Restrict to Internal Network
Yes, your assumption is correct. You can bet that large websites don't make their admin dashboards reachable by those not on an internal network. You mentioned VPN. If possible, make admin dashboards only available on the internal network.

Improve this answer
0

The simplest way to resolve this is to host the admin portal on the same domain, then restrict the pages based on IP addresses, like the block your business is assigned, or a common VPN connection. Apache and NGINX come with this functionality by default. Then, if you need to allow contractors or remote workers, you whitelist those IP addresses too and maintain the security of your portal.

Improve this answer
2
  • If this is the simplest way, what other ways are there? I'd like to know!
    – Zero
    Mar 8, 2016 at 19:17
  • @Duos You can build in user roles. As in, only users with the role "admin" can access the admin page. But that introduces its own problems as you have to make sure the user roles are airtight and you can't usurp privileges.
    – Ohnana
    Mar 8, 2016 at 19:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .