0

I have OwnCloud setup and it has a feature called External Site. It loads a site in an iframe, so you can stay in the websites shell.

I have a page running on a reverse proxy. Is there anyway to only allow the OwnCloud page to access the reverse proxy while blocking any other connections to it?

So in this situation, the OwnCloud site is publically accessible but I don't want the reverse proxy to be.

On apache2, Ubuntu 14.04, own cloud 7

1 Answer 1

0

With an iframe, the user's browser is still loading the page assets directly, so there's no good way to limit by IP or anything similar to that. So, what you're describing is really more security by obscurity, which isn't true security at all.

In the end, you need to protect your reverse proxied application with some type of authentication.

3
  • Is there any way to harden it around the referer and IP? Since the page is making the request, it could distinguish something I suppose. Aug 19, 2014 at 3:14
  • Like I said, blocking via IP is a non-starter, since the clients will be making the request. Likewise, referrer IDs are easily spoofed. You really just need to bite the bullet and implement some type of authentication.
    – EEAA
    Aug 19, 2014 at 3:15
  • Argh! Alright then. Better safe than convenient. Aug 19, 2014 at 3:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .