How to make admin site safe?

Question

very simple question: I have admin site in my web project. So, how can I make it safe?

What I have until now:

• Database handled user with userID and userlevel
• on the pageload of the admin master page (which includes all admin sites) there is a clause to check if userID is okay (get the user from database) and if userlevel is right
• If Not, redirect to Default.aspx with normal master page
• if yes, go trought

How safe is it really?

---

Edit:

• The userID is saved in a session on the server.
• There is no way to save the login (no cookies).
• The user must login to get the userID in the session
• The login is saved in a database table user_log with username, password, ip, loginsucceeded and userID

Answer 1

The basic idea looks ok. It all comes down to how you are getting that UserID to make the checks against. If the userID is being passed as a querystring, then that is very bad. If it is stored in a session via sometype of pre authorization then it is better. If you are using SSL, IP checking, etc it will improve your level of security.

The main thing is HOW you are getting the userID to verify against. That is where the exploit will occur. Secure that process and you should be ok with your setup.

Edit: Based on your update this looks ok but it also depends on how secure you really need this to be. How secure is your sign in page? Are you using SSL? Any worries about session highjacking? Why not store an IP with the userID and verify the request IP against the stored IP when doing the UserID fetch from the session?

There are so many security solutions out there. You need to decide how far you need to safely go to ensure the level of security that is necessary for your particular application.