I created a web admin panel with the following security implementation.
- It is located on a sub directory of the web, which will trigger a 404 Error when tried to access (just like the link is broken or doesn't exist).
- This (only if correct sub directory is opened) in turn sends an email to the administrator, with a url, which has a token.
- The token is of 2 parts, one is a random md5 of 5 random 5 digit numbers, another one is a
md5(strrev(md5(IP_ADDR)))
. The token is saved in the database by invalidating all the other sessions. - These tokens are separated by a _ sign.
- When admin (or anyone) tries to access the URL, first the IP token is matched whether the same IP is accessing the URL. If not, 404 page is shown.
- If yes, then the random token saved on database is matched against the one which was sent on mail. If this is also successful, the admin panel opens.
- Any invalid try will show 404 error.
- This token will automatically get invalidated for every 20 min, thanks to the cron job.
Provided, the email can only be opened by the administrator of the website.
What could be the flaws in this implementation? How can this be improved?