Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have OwnCloud setup and it has a feature called External Site. It loads a site in an iframe, so you can stay in the websites shell.

I have a page running on a reverse proxy. Is there anyway to only allow the OwnCloud page to access the reverse proxy while blocking any other connections to it?

So in this situation, the OwnCloud site is publically accessible but I don't want the reverse proxy to be.

On apache2, Ubuntu 14.04, own cloud 7

share|improve this question

1 Answer 1

up vote 0 down vote accepted

With an iframe, the user's browser is still loading the page assets directly, so there's no good way to limit by IP or anything similar to that. So, what you're describing is really more security by obscurity, which isn't true security at all.

In the end, you need to protect your reverse proxied application with some type of authentication.

share|improve this answer
    
Is there any way to harden it around the referer and IP? Since the page is making the request, it could distinguish something I suppose. –  soundsofpolaris Aug 19 at 3:14
    
Like I said, blocking via IP is a non-starter, since the clients will be making the request. Likewise, referrer IDs are easily spoofed. You really just need to bite the bullet and implement some type of authentication. –  EEAA Aug 19 at 3:15
    
Argh! Alright then. Better safe than convenient. –  soundsofpolaris Aug 19 at 3:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.