I am writing an application which will be used for our core business workflows (client registration and management etc).

I have partners and employees who are spread across the globe, so I want to make them be able to log in and use the application, over the internet - but I want to bar everyone else (including bots and indexers) from accessing my web application.

I am using Apache as the web server, and I am using xxx.mydomainname.com to access my web application

How can I secure the application so that only the following entities can access the application:

1. Machines on my company LAN (windows networked computers)
2. Specific machines connecting across the internet

I specifically, do not want the pages indexed and archived by any bots etc, since the pages contain sensitive client information etc.

How can I secure my web application to BAN all access and permit only those specified above?

  • By making everyone log in. – Michael Hampton Feb 11 '15 at 16:46
  • @MichaelHampton: I wanted to prevent brute force attacks by serving a 404 page when any of the unauthorized machine/network combo tries to access a page (I'm aware of IP spoofing, but hopefully, this is not in the arsenal of the novice/average/wannabe hacker) – Homunculus Reticulli Feb 11 '15 at 16:55
  • You prevent brute force attacks with strong passwords and rate limiting. The problem is that you have no way of knowing where a valid user will be logging in from. It could be from their office or an airport lounge in Dubai. – Michael Hampton Feb 11 '15 at 17:00
  • @MichaelHampton: Thanks for your comment; its made me realize that perhaps I should have framed the question differently. Strong passwords, rate logging and required logging will solve most of the problems relating to bots etc - however, that solution does not prevent an employee to login into the application from a wine bar (for example), and leave client details exposed to the world, so I think the problem decomposes into one of restricting access by IP address (or something similar) – Homunculus Reticulli Feb 11 '15 at 18:10
  • Why is it a problem to log in from a wine bar? – Michael Hampton Feb 11 '15 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.