I am still a noob and autodidact in the network field, so please forgive me if what I am going to ask is just wrong.
I have implemented a login system in PHP and now the clients can access my app via it. While signed in, the app is serving some web services which users could not see while not signed in. Well, theoretically...
Indeed, as of now, if the user knows the direct URL to these services (which can be retrieved e.g. via a web console), he/she can access the resource, regardless of whether he/she is logged in.
The web services are generated by a CGI program.
I'd like to find a way to secure these services so that nobody except my web application (or even better, also the logged in users) can access them.
I thought about a reverse proxy, but as I am very new to this stuff (I am doing this only to learn for now) and never tried to implement one, I am not entirely sure if this is the way to go.
So, I made an illustration showing what I have in mind (hope it's clear). Would this be the (one) right way to solve my issue?
- the web application, the web services and the proxy server will be in the same machine
- the URL to my app is something like
mysite.comand to reach a web service the URL is like