I currently develop a big blog website with Firebase as my backend just for information. Right now (not released/published the page yet), I give my authors accounts special rights to access pages others can't access (I protect them via a middleware). On those, they can publish or edit posts that will appear on the page.

I thought this may have security risks. Would it be more secure to give them a local piece of software that does all that the author panel does now? That way no one except the authors could access it. Is this additional security step even useful and are there any other ways to enhance the security?

  • It depends on what risks you see and what problems that you want to avoid. If the local software allows authors to edit other posts, what risks is the local software meant to address? – schroeder Oct 17 '18 at 11:22
  • @schroeder The Risk is that people that are not intended to write Posts are able to, for example somehow mimmicking an Authed User to the Website somehow, no one external would have access to a local Programm and i could protect it with a extra password. – Badgy Oct 17 '18 at 11:31
  • @schroeder I could be completly wrong here so thats why I ask – Badgy Oct 17 '18 at 11:32
  • You want to protect against account compromise on the author accounts. You are thinking that you could have the remote clients authenticate more securely through code to your website than the users can manually. Well, it all comes down then to how secure your code is. The much better option is to turn on 2FA on the server-side accounts, if you can do that. It's pre-made, proven to be strong, and meets your control goals with no overhead. – schroeder Oct 17 '18 at 11:36
  • @schroeder I am not worried about the accounts getting lost specially because the Authors use the Google Sign In which has built in 2FA, the problem is that im scared that my Middleware Code is not secure enough against experienced people that wanna get access to restricted areas (in this case the author area) – Badgy Oct 17 '18 at 11:41

Both setups - publish posts via website and publish posts via local software - requires some kind of authentication. No matter if the user is making HTTP requests through a web browser or some other program, the server will need to authenticate them. If you get that authentication right you will be fine, if you get it wrong, you will have problems. The type of software isn't really the determining factor.

A separate application will give you a bit of obscurity. But I would not focus on that. The authentication is what is important here.

  • Yes, the Client Side is protected via Authentication and the Server Side also has addiotional Security rules to only allow changes in the DB from certain Users, but dont know if storing the Auth in the Cookies to have a persistent Auth on Page reload is a security flaw... and can be modified to trick the Middleware and the Server ? – Badgy Oct 17 '18 at 8:55
  • 1
    @Badgy The server side needs to do all authentication no matter the setup. The server must never trust the client. – Anders Oct 17 '18 at 8:57
  • As for your other questions, I know to little about your system to say anything. It sounds like a very broad question that can not really be answered. – Anders Oct 17 '18 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.