0

I am working on an E-commerce website which is mainly in Django.

I have this admin page. I want to hide, protect, secure it from other users/visitors means that only a set of IP address can view that and login with their credentials. is it possible? I have heard about IP whitelisting but IP's can be faked and also someone suggested that just don't publish it. if I choose not to publish make the desktop app for admin then how this work. Please explain.

2
  • Some tips: 10 tips for making the Django Admin more secure. On top of that you can whitelist IP addresses using .htaccess if you use Apache for example. And no, one cannot easily spoof your IP address.
    – Kate
    Commented May 8, 2020 at 13:46
  • IPs cannot be faked to be able to login to things.
    – schroeder
    Commented May 8, 2020 at 15:33

1 Answer 1

1

I have heard about IP whitelisting but IP's can be faked

In the real world, it's impossible: there's no way to establish a 2-way communication over faked IP. It's like writing a letter to someone, fake your own address, and expect to hear anything back. The person will receive the letter, and answer to the address you faked, not to you. IP spoofing works exactly the same.

The downside of the whitelist is that you must have a static IP. If your IP changes, you are locked out.

This answer on StackOverflow shows you how you whitelist direct on Django. the idea is to create a Middleware or a Decorator to take care of the whitelist for you. If you are hosting Django behind a reverse proxy (HAproxy, Nginx, Apache, et al), you can use the reverse proxy configuration files for that.

and also someone suggested that just don't publish it.

You have to publish, or you won't have the admin page. You may choose to keep the admin page unpublished until you need to access the admin page, and them you publish it, do the job you need, and unpublish again. Cumbersome, but works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .