I have many applications installed on my server that use a webui frontend to control the application.
Since I am the only user of the server, I usually bind these applications to 127.0.0.1.
As the services are bound to localhost, I have assumed that I can disable authentication (usually username+password), for these applications, because nobody outside of my local machine can even access the services.
I access the services by using an SSH tunnel; so essentially it gives me access to the server's local services from any machine.
An example: I installed BitTorrent Sync. The app uses a webui that I bind to 127.0.0.1. I then disable username+password auth for this webui, and access it using an SSH tunnel from my remote location.
My question is, is this secure? Would it be better practice to enable the application's authentication scheme? (I assume not, since it is bound localhost). Is it possible for an attacker to somehow spoof 127.0.0.1 and get access?