I'm creating a web application for internal use at work. Mostly basic relational database structure (customers, orders, movies, etc.). It will be used in a multiple shops across town.

What is the best practice to expose app for employees? Maybe configuring VPN server which will allow to connect to network where frontend and backend is running? Or exposing whole server to public Internet?

  • Welcome! I am not sure this is a security question, what you're essentially asking is - "How can my colleagues/employees view a web-app I've created?" which isn't a security question. – J.J Aug 23 '18 at 9:30

Your question (as stated by Joshua) isn't necessarily a security concern. But part of it might be, so here is some background information you might want to think about:

If you create a webapplication and create it with security in mind, your two most likely risks might be: 1) Leakage of data (e.g. from your database) and 2) compromization of the server and (afterwards) an attack from that point towards your clients or third parties. If your webapplication is using proper authentication and all the well known security mechanisms it may very well be sufficient and you could just put it on the internet (that's what quite a lot of sites do ;). You could as well put it on an internal vpn and decrease the attack surface in that way. An attacker would have to gain access to the vpn, before being able to attack the server itself. This might increase attack complexity but also increases the complexity of your infrastructure. Since both can be equally safe and unsafe this is not really a security question.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.