I am still a noob and autodidact in the network field, so please forgive me if what I am going to ask is just wrong.

I have a web application based on JavaScript and PHP and served from my Apache web server.

I have implemented a login system in PHP and now the clients can access my app via it. While signed in, the app is serving some web services which users could not see while not signed in. Well, theoretically...

Indeed, as of now, if the user knows the direct URL to these services (which can be retrieved e.g. via a web console), he/she can access the resource, regardless of whether he/she is logged in.

The web services are generated by a CGI program.

I'd like to find a way to secure these services so that nobody except my web application (or even better, also the logged in users) can access them.

I thought about a reverse proxy, but as I am very new to this stuff (I am doing this only to learn for now) and never tried to implement one, I am not entirely sure if this is the way to go.

So, I made an illustration showing what I have in mind (hope it's clear). Would this be the (one) right way to solve my issue?

Some info:

  • the web application, the web services and the proxy server will be in the same machine
  • the URL to my app is something like mysite.com and to reach a web service the URL is like mysite.com/cgi-bin/...

enter image description here


So apparently I've solved by implementing another solution: HTTP Basic Auth.

I basically followed this guide and:

  1. Installed apache-utils

sudo apt-get update sudo apt-get install apache2-utils

  1. Created a .htpasswd file with a user and a password in /etc/apache2 folder

    sudo htpasswd -c /etc/apache2/.htpasswd <my_user>

  2. Modified my Virtual Host configuration by adding these lines (in bold)

<Directory "/usr/lib/cgi-bin/"> AuthType Basic AuthName "Restricted Content" AuthUserFile /etc/apache2/.htpasswd AllowOverride All Options +ExecCGI -MultiViews +FollowSymLinks Order allow,deny Allow from all AddHandler fcgid-script .fcgi Require valid-user </Directory>

  1. restart apache

sudo systemctl restart apache2

Now, what happens:

  • If I test my secured resource typeing the direct URL (e.g. mysite.com/cgi-bin/...) I am asked to enter the credentials.
  • If I access via my app, I am always asked for the credentials

Obviously, everything is under SSL/TLS protocol.

So far so good. I now have to implement a way to don't ask for the credentials of the secured resource when the user logs in in my app, but this is another problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.