Ben94's avatar
Ben94
OP
7 years ago
Level 1

I'm nervous that my app's security has flaws. Asking for feedback.

This is my first freelance job for an IT company. The requirement is that the website has two use-cases.

  1. Customers (other companies) need to log in and be able to view their orders from our SAP production DB.
  2. Employees from 'my' company need also be able to log in and view some internal information pulled from their production database.

What I have done to make the site a bit more secure:

  • I have two databases, one is a simple MySQL db for users. The other is a fully productional SAP B1 database. Both usernames and passwords are configured in the .env file.
  • The connection with the SAP database is from a user that has only read-only access.
  • The sensitive Laravel Models that connect to the Production database have read-only traits (for extra making sure.)
  • Every route except login has an auth middleware so people get redirected when not authenticated.
  • (Here's the risky one I'm uncertain of) I have a route /getData that still has that auth middleware. If you go to /getData you'll be redirected. Is this hack-proof/can I test this?

Are these proper steps? And a more global question: How can I make absolutely sure my site is secure? Any tips, things to really take into consideration or more?

Ik know this is probably a broad question so if anyone can find an extensen tutorial/small book on the subject I'd love to hear it. (Couldn't find one myself.)

0 likes
6 replies
artcore's avatar

Your Laravel setup sounds good to me. Did you also harden the server itself? Thinking of no remote db access, bind to 127.0.0.1 anti-ddos hardware, datacenter quality mod_security suhosin firewall, auto-block failed logins with admin email? no directory browsing ftp/ssh restrictions dnssec backup remotely :)

I would also log successful logins and check for anomalies like IP changes

Ben94's avatar
Ben94
OP
7 years ago
Level 1

@ARTCORE - Thank you for the quick reply. It's not online yet and the database is entirely in the hands of SAP if that is what you meant :). Autoblocking failed attempts is a great solution I did not yet think about.. Some other terms you said are unbeknownst to me so I'll google them. :) Thank you.

artcore's avatar

you're welcome! and I learned that tabs in this forum don't get parsed ;)

1 like
shadrix's avatar

@primordial Actually, I'm wondering. Why is this the case? What are the bots trying to do? I added whois to my fail2ban and I constantly see big companies attacking me, like Microsoft et.c

primordial's avatar

@shadrix The bots are trying to identify the operating system you are running. If they can determine the O/S they can then test for known vulnerabilities and if you haven't kept your O/S patched and uptodate they maybe able to gain access.

Please or to participate in this conversation.