阻止用户访问管理员登录页面

Question

Currently I am setting up an admin login page with PHP and this is how I have it set up.

If the user navigates to website.com/admin, it returns a 404 error. The only way to get access to the admin login is to go to website.com/admin?key=random-string. If the key in the URL doesn't match the key in the database it will return a 404 error. When the key matches it will present you with the admin login.

I thought this was clever to help prevent someone from getting access to the admin login screen, but I am not experienced enough to know if this is true.

Answer 1

I thought this was clever to help prevent someone from getting access to the admin login screen, but I am not experienced enough to know if this is true.

Do not try and defeat an attacker by trying to outwit them. Always assume attackers are clever than you are, and build your security on that model.

Make your login and session management system is provably secure instead. For example:

• Employ two factor authentication.
• Use HTTPS along with Secure cookies and HSTS.
• Rate limit or lock accounts after a number of failed logins.
• Make sure you are not vulnerable to session fixation.
• Make sure you are not vulnerable to user enumeration.

Checkout the Session Management Cheat Sheet for some more pointers.

Also, don't use secrets in the URL itself. Even though these are protected if HTTPS is used, they are logged in browser and proxy history, by server logs by default, and can be leaked in referer headers.