0

I'm building some simple dashboard app for myself, but I want to have them on multiple devices - hence the server and front end. As I will be the only user who will access the application server, what security should I implement?

Stack: Postgres Ktor (Kotlin) server, HTTPS, only REST API Front end

I'll run AWS Lightsail instance since I don't need anything heavy. Postgres and application server will be there, with only ports 443 and 22 open. Front end will be on S3 with CloudFront.

I'm doing this because it's easier for me to make a browser "app", than to make an Android app + something for desktop and keep them in sync.

I'll be using the app from multiple networks. At home (where I don't have a static IP, which would solve some of the problems), from mobile network, from work, when traveling to other countries, etc.

For background, I've been working on server for almost 3 years, Spring + Hibernate, Postgres. I have a fair knowledge of linux, hosting a server on it, some of AWS services and basic knowledge of database administration. I've done a bit of front end, but I'll have to get back to that soon. I have almost no knowledge of security beyond basic JWT and SSH.

5
  • Being the only one to browse it if it's online on aws is kind of hard. You could have a 2FA authentication scheme, so you will be the only one able to use it, or create a frfont VPN server to which will you connect and have the app in another server behind it. That's the easiest i can think of. – Chris Tsiakoulas Jul 12 '20 at 10:59
  • Yes? What is your question? – Conor Mancone Jul 12 '20 at 11:56
  • @ChrisTsiakoulas thanks for your response, it makes sense for that to work, I don't know why I haven't thought about it. I'll give it a try, but from my perspective, it's just one more thing to keep up to date and I need to connect to VPN from all of my devices in order to get to the site. Simply said: "too many clicks". But if nothing else works, this will :) – milos.garunovic Jul 12 '20 at 14:15
  • @ConorMancone you're correct, i put a dot and not a question mark on the end of first paragraph, sorry about that. – milos.garunovic Jul 12 '20 at 14:15
  • 1
    This is very broad for stack exchange. What security should you implement? Only you can answer that. There is never one answer to that question anyway. The amount of "security" you need is completely different depending on whether you are building an anonymous cutest-cat-picture voting site, a web portal to launch nuclear missiles, or a glove that can destroy the universe. – Conor Mancone Jul 12 '20 at 14:19
1

I did something similar before. The web version I put behind a VPN, which had a local rule to forward an IP to a locally hosted webserver. This works if you just want to keep it on web.

I then expanded on it where I actually had a mobile app to pull information through an API. That mobile app had certificate that would allow mutual authentication on the proxy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.