Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • I understand how frustrating it is to give an answer and then have the OP say "nope", can't go with the optimal solution. Sadly, I am not in a position to implement a full separation, so I only want to do as much as I can from my side, given the limitation. I also understand that generally a VPN provides access to a network, not a resource. But couldn't I perform an IP check in the application code? I would only have a few admins, so if I set up the VPN with a static IP and then check if host == admin.mystore.com and ip == vpnIP, proceed with admin login... Is that bad? Commented Sep 14, 2018 at 8:48
  • no problem, I'd love to be able to give you a clever work around, but unfortunately I don't know of any :( Commented Sep 14, 2018 at 8:49
  • Accidentally posted the comment too early. Made an amendment now, could you take a look? Also, thank you for the answer, I particularly appreciate the support on the separation idea, makes me feel less incompetent, lol. Commented Sep 14, 2018 at 9:42
  • 1
    yes you can put extra checks in for the admin user, but i assume you existing permissions system already distinguishes between the user types. an extra ip check might work, but your not significantly improving the solution Commented Sep 14, 2018 at 10:04