Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have OwnCloud setup and it has a feature called External Site. It loads a site in an iframe, so you can stay in the websites shell.

I have a page running on a reverse proxy. Is there anyway to only allow the OwnCloud page to access the reverse proxy while blocking any other connections to it?

So in this situation, the OwnCloud site is publically accessible but I don't want the reverse proxy to be.

On apache2, Ubuntu 14.04, own cloud 7

share|improve this question
up vote 0 down vote accepted

With an iframe, the user's browser is still loading the page assets directly, so there's no good way to limit by IP or anything similar to that. So, what you're describing is really more security by obscurity, which isn't true security at all.

In the end, you need to protect your reverse proxied application with some type of authentication.

share|improve this answer
Is there any way to harden it around the referer and IP? Since the page is making the request, it could distinguish something I suppose. – soundsofpolaris Aug 19 '14 at 3:14
Like I said, blocking via IP is a non-starter, since the clients will be making the request. Likewise, referrer IDs are easily spoofed. You really just need to bite the bullet and implement some type of authentication. – EEAA Aug 19 '14 at 3:15
Argh! Alright then. Better safe than convenient. – soundsofpolaris Aug 19 '14 at 3:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.