1

I am currently creating a personal "local" website. I do not plan on port fowarding to make it accessible to those outside my network. Will that be good enough for security, what about people on the same local network as I am, how can I block any other PCs from accessing my website, or password protect it?

I feel that HTTPS is not needed for this type of setup due to it being a local website, but I have connection to many APIs: Google Maps API, Facebook API, etc. Can my site be compromised without having HTTPS?

  • 1
    Is it running on your workstation/laptop or a separate server in the LAN? – HashHazard Sep 1 '16 at 17:52
  • Do you have one or more wireless APs in your network? – ott-- Sep 1 '16 at 18:10
  • While not an answer I do want to mention HTTPS on a completely local network is low hanging fruit. Self signed certificates are free and easy to implement. Less than 5 minutes of work removes the concern. – Bacon Brad Sep 1 '16 at 21:29
2

Local network or local machine? For the latter, bind to localhost only for the webserver, database and such. If you are running the application in a LAN on a remote server, then HTTPS is not that strange. Depending on the threat you expect, create a access policy on the webserver.

  • But how does HTTPS protect the site from being accessed? It will prevent traffic sniffing (i.e. cred disclosure) but doesn't solve the accessibility problem. I'd probably use client certs for that. – HashHazard Sep 1 '16 at 17:59
  • @Hollowproc Hence the access policy on the webserver. The SSL will indeed protect credentials, which he should care about as soon as this involves private data. – Yorick de Wid Sep 1 '16 at 18:06
  • Fair enough.. I glazed over the access policy on the webserver part. :) +1 – HashHazard Sep 1 '16 at 18:10
  • @Hollowproc gehe thx :) – Yorick de Wid Sep 1 '16 at 18:12
  • I pretty much just wanted to see if I could make it to where, let's say that my webserver is on my local machine and is running on Apache at 127.0.0.1, and someone else on the same local network as me such as my brother went to the same url and had access to my site. I have a login page on my site can I make it to where if he or anyone tries going to that url, it'll redirect them to the login page? Sorry if I sound dumb, I'm not too big on webserver security/configurations. – Thomas Byerly Sep 1 '16 at 18:31
0

If you are not sharing the website to people outside the network, ensure that you have proper network controls (ACL's) in place to ensure that users from outside cannot access it.

The problem about cleartext protocols (HTTP instead of HTTPS) is that a local network user could perform a Man-in-The-Middle attack, hijacking traffic between your website and its users. If your website has any "sensitive" information on it, you should probably consider encrypting that communication.

What API's you use are not that much of a concern, keeping in mind that all scripts you load from external hosts have the same rights in the same context as your active content (such as Javascript).

0

Pehaps you do not plan to make it accessable to outside world, but it could still happen (for example, some other machine that has access to LAN being compromised).

Only you can do risk assessment for your case - that is, calculate what chances are of bad thing happening, and how bad is worst thing that can happen - and from there derive how much (if any) effort are you willing to put in to prevent it from happening (and/or insuring against)

0

HTTPS is necessary if there are potential access points to the network. For an internet-facing site, HTTPS is highly recommended.

If your service is localhost then there's obviously no such concern, because there's no network.

If the service is only available on the LAN, then you should ask the security level of that network before you run an (insecure) HTTP service.

  • Are all the network cables physically secured from potential attackers who may want to eavesdrop or hijack the HTTP connection?

  • If you have WiFi, then how well kept is the password when a guest asks 'can I use your WiFi'? Also is the WiFi securely configured?

  • Are all the computers with access to the network well secured and run by competent users?

So there you have it, consider these things and you'll know whether an insecure protocol is acceptable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.