My colleagues and I are developing a public web application with client and admin access.
I'm concerned about security, being the application public. I would like to add every layer, as long as it's useful and really provides security.
I thought that preventing the client access being the same as the admin access, would add one of such layers.
One idea idea is to create subdomains for each, like client.app.com
and admin.app.com
, though each subdomain points to the same site.
I'm picturing a scenario where an admin user name is trying to access from the client interface, then the source IP could be blocked.
The application counts with authorization and access control of the resources and routes.
Is this a good approach concerning security?
Should we add some other layer of access control?
We are using the Laravel framework.