Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to set up an administrative web application in the subfolder /admin of my domain.

I would like to make sure this app is as secure as I can make it (not because it is absolutely necessary, but because I'm interested in learning web security) and I want it to run over https, while the rest of the website (non-admin locations) should be http.

I've got nginx got it set up as is explained in this answer:

# non ssl locations
server {
    server_name test.romeovansnick.be;
    listen 80;

    root /var/www/test;

    location / {
        index index.html;
    }

    location /admin {
        return 301 https://test.romeovansnick.be/admin/;
    }
}

# secure server
server {
    listen 443 defaul_server ssl;
    server_name test.romeovansnick.be;

    root /var/www/test;

    location / {
        return 301 http://$server_name$request_uri;
    }

    location /admin {
        index admin.php;
        # add_header Strict-Transport-Security max-age=31536000;
        add_header X-Frame-Options DENY;
    }

    # ssl setup ...
    # php setup ...
}

The problem here is that I think I'm still susceptible to man in the middle attacks. At least according to OWASP, simply redirecting users is not entirely safe.

I thought I could reduce the risk of man in the middle attacks by adding the HSTS header to /admin locations, but this causes redirect loops to occur in browsers that support it. I think because the browser applies this to the whole domain test.romeovansnick.be (or I haven't tested enough).

How can I make my webserver more secure against such attacks?

share|improve this question

1 Answer 1

If /admin is supposed to only be accessible to administrators of the web site/web application, I wouldn't expose it to the Internet via nginx if it can be avoided.

share|improve this answer
    
it is to be used as a settings pane for a simple cms system, to be used by the website's owner to upload images etc.. I'm just for the first time writing this kind of stuf myself. (I know it's probably better to use some existing stuff, but it is a fun thing to do for learning php security / web application basics). –  romeovs Jan 21 '13 at 14:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.