0

I'm trying to set up an administrative web application in the subfolder /admin of my domain.

I would like to make sure this app is as secure as I can make it (not because it is absolutely necessary, but because I'm interested in learning web security) and I want it to run over https, while the rest of the website (non-admin locations) should be http.

I've got nginx got it set up as is explained in this answer:

# non ssl locations
server {
    server_name test.romeovansnick.be;
    listen 80;

    root /var/www/test;

    location / {
        index index.html;
    }

    location /admin {
        return 301 https://test.romeovansnick.be/admin/;
    }
}

# secure server
server {
    listen 443 defaul_server ssl;
    server_name test.romeovansnick.be;

    root /var/www/test;

    location / {
        return 301 http://$server_name$request_uri;
    }

    location /admin {
        index admin.php;
        # add_header Strict-Transport-Security max-age=31536000;
        add_header X-Frame-Options DENY;
    }

    # ssl setup ...
    # php setup ...
}

The problem here is that I think I'm still susceptible to man in the middle attacks. At least according to OWASP, simply redirecting users is not entirely safe.

I thought I could reduce the risk of man in the middle attacks by adding the HSTS header to /admin locations, but this causes redirect loops to occur in browsers that support it. I think because the browser applies this to the whole domain test.romeovansnick.be (or I haven't tested enough).

How can I make my webserver more secure against such attacks?

0

HSTS is domain-wide, not subdirectories. If you want to have HSTS on it, use another domain, or a subdomain.

admin.test.romeovansnick.be or admintest.romeovansnick.be for instance. Or for 0.01€ extra security by obscurity, use john.romeovansnick.be or something other hardly guessable. ;-)

0

If /admin is supposed to only be accessible to administrators of the web site/web application, I wouldn't expose it to the Internet via nginx if it can be avoided.

  • it is to be used as a settings pane for a simple cms system, to be used by the website's owner to upload images etc.. I'm just for the first time writing this kind of stuf myself. (I know it's probably better to use some existing stuff, but it is a fun thing to do for learning php security / web application basics). – romeovs Jan 21 '13 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.