Restrict an admin panel to admins

auth-admin-panel

An admin panel was reachable during the scan. If it should be limited to administrators, check the user's role on the server for every admin route and action.

Why this matters

An admin panel surface was reachable during the scan. Whether the account held any administrative capabilities was not established.

Your stack

Nginx

1 Block public access to admin paths at the proxy level

nginx

location /admin {
    # Allow only from internal IPs
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://backend;
}

Express

1 Add role-based access control to admin routes

javascript

function requireAdmin(req, res, next) {
  if (req.user?.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  next();
}
app.use('/admin', authMiddleware, requireAdmin);

Django

1 Use @staff_member_required or @permission_required

python

from django.contrib.admin.views.decorators import staff_member_required

@staff_member_required
def admin_view(request):
    # ...

Rails

1 Add role-based authorization to admin controllers

ruby

class AdminController < ApplicationController
  before_action :require_admin

  private

  def require_admin
    head :forbidden unless current_user&.admin?
  end
end

Does your app still have this?

Scan your domain

Restrict an admin panel to admins

Web servers

Frameworks

Nginx

Express

Django

Laravel

Rails

Spring Boot