Secure the `/admin` page in production

nfoert / cardie

An open source business card designer and sharing platform

https://cardie-uwtwy.ondigitalocean.app/

GNU General Public License v3.0

384 stars 24 forks source link

Secure the `/admin` page in production #69

Open nfoert opened 3 weeks ago

nfoert commented 3 weeks ago

Look into the best methods for protecting the admin interface in production

Change the url path to the admin page
Use django-otp for one time passcodes
Allow only certain IP addresses to access the admin page (using iptables?)

ar4s commented 3 weeks ago

Change the url path to the admin page

This project is public (everyone view urls.py) so I suggest to determine this path by configuration on the server (by environment variable ofc :wink: ) with /admin/ a default for testing and development purpose.

ar4s commented 3 weeks ago

@nfoert I can take care of the first and second bullet points.

nfoert commented 3 weeks ago

@nfoert I can take care of the first and second bullet points.

Okay, thank you @ar4s!