When securing a web server/web application/website, you often have the choice between choosing something like using a password for authentication/securing a service and creating an IP whitelist or whitelisting a whole subnet.
Or e.g. using/hosting the service in a subdirectory (may be faked/configured by the web server) that is not guessable, like
So I have three common mechanisms.
Things that should be clear
Obviously, some first thoughts:
- IP blacklists are obviously not that secure – you can't just blacklist all "bad attackers".
- The password/passphrase/string authentication of course is only secure, if it is chosen properly, e.g. totally randomly string for the URL. (like shown in the example above)
- Of course, you may be tempted to say "just combine them all", but let's say that for usability/convenience reasons, this is not what I want (at least not combine them all), so as I'd need to create a "best-of" trade-off I would be in the need of a ranking of what is the best?
(This is a hypothetical/general question. I deliberately did not choose a specific web service/example, to make this useful for the general public.)