0

I'm building some simple dashboard app for myself, but I want to have them on multiple devices - hence the server and front end. As I will be the only user who will access the application server, what security should I implement?

Stack: Postgres Ktor (Kotlin) server, HTTPS, only REST API Front end

I'll run AWS Lightsail instance since I don't need anything heavy. Postgres and application server will be there, with only ports 443 and 22 open. Front end will be on S3 with CloudFront.

I'm doing this because it's easier for me to make a browser "app", than to make an Android app + something for desktop and keep them in sync.

I'll be using the app from multiple networks. At home (where I don't have a static IP, which would solve some of the problems), from mobile network, from work, when traveling to other countries, etc.

For background, I've been working on server for almost 3 years, Spring + Hibernate, Postgres. I have a fair knowledge of linux, hosting a server on it, some of AWS services and basic knowledge of database administration. I've done a bit of front end, but I'll have to get back to that soon. I have almost no knowledge of security beyond basic JWT and SSH.

Improve this question
5
  • Being the only one to browse it if it's online on aws is kind of hard. You could have a 2FA authentication scheme, so you will be the only one able to use it, or create a frfont VPN server to which will you connect and have the app in another server behind it. That's the easiest i can think of.
    – Chris Tsiakoulas
    Jul 12, 2020 at 10:59
  • Yes? What is your question?
    – Conor Mancone
    Jul 12, 2020 at 11:56
  • @ChrisTsiakoulas thanks for your response, it makes sense for that to work, I don't know why I haven't thought about it. I'll give it a try, but from my perspective, it's just one more thing to keep up to date and I need to connect to VPN from all of my devices in order to get to the site. Simply said: "too many clicks". But if nothing else works, this will :)
    – milos.garunovic
    Jul 12, 2020 at 14:15
  • @ConorMancone you're correct, i put a dot and not a question mark on the end of first paragraph, sorry about that.
    – milos.garunovic
    Jul 12, 2020 at 14:15
  • 1
    This is very broad for stack exchange. What security should you implement? Only you can answer that. There is never one answer to that question anyway. The amount of "security" you need is completely different depending on whether you are building an anonymous cutest-cat-picture voting site, a web portal to launch nuclear missiles, or a glove that can destroy the universe.
    – Conor Mancone
    Jul 12, 2020 at 14:19

1 Answer 1

Reset to default
1

I did something similar before. The web version I put behind a VPN, which had a local rule to forward an IP to a locally hosted webserver. This works if you just want to keep it on web.

I then expanded on it where I actually had a mobile app to pull information through an API. That mobile app had certificate that would allow mutual authentication on the proxy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .