Home/ Questions/Q 7762445
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T14:24:16+00:00

I’ve developed a CMS app, that stores all the client’s files on their server

  • 0

I’ve developed a CMS app, that stores all the client’s files on their server but does the processing on mine (i.e. keeping hold of the valuable code I developed, while not allowing user submitted code to make my site vulnerable). Now the issue is the user has a control panel to edit their website, this is hosted on their website, it’s a 1 page thing, but the login details/sessions are always on my website.

I was thinking of having a way of making the edit page on there site only accessible if a token passed is valid, both sites can have the same way to develop and check the same token. Is this acceptable security, I mean the only exploit I can think of is if the URL was somehow sniffed and used independently in the same time frame that the token is still valid. Checking headers is an optional extra bit of security but these can be faked so it’s not an absolute solution. I don’t know how easy it is to sniff a users web traffic, would this method be ok to use?

Thanks in advance.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Well, sniffing attacks are readily defeated by just encrypting your transport (i.e. using SSL), so long as you also verify certificates (to defeat a man-in-the-middle attack).

    I’m not sure I fully understand your setup, but it seems like you should have the edit page call out to your backend server, passing it the token for authentication. Is that what you intended, or…?

    • 0