Secure Login to the Manager

The website I run is non-secure, however I am concerned about the fact that the manager login is also non-secure. This is particularly because I am now using a wireless connection to access my website, and even though I’m using WPA, I don’t trust it. I am running modx on a webhost that provides ssl through an ssl folder. When someone tries to access a page in the ssl folder, the communication is redirected through the webhosts ssl server. If I attempt to move the manager folder to the ssl folder - obviously that won’t work unless I want to move the entire site to the ssl folder and make it all secure (which I don’t want to do). I thought it might be possible to make a copy of the manager folder in the ssl folder, so that the secure manager would edit the website, and the non-secure manager files would display the website, but I’m afraid that that may cause problems. Actually I don’t need the entire manager session to be secure, just the login. Is it possible to make it so that all the files associated with logging in can be seperated from the manager, so that a login can be sent over ssl, and then the login code could redirect to the non-secure manager. I’d be willing to contribute to the coding, I’d just like to know if it’s possible without too much work, and If there’s any idea on how best to go about doing so - or any better ideas on how to secure the login.

Thanks in advance

I second this request. Dunno how hard it is to make, but would be nice to have.

Quote from: Mitch at Jun 07, 2005, 01:10 PM

I second this request. Dunno how hard it is to make, but would be nice to have.

Ryan and I were discussing this earlier today and we are already planning to make the location of the manager configurable in an upcoming release. This will require removing all the dependencies between the two and isolating the common code where both can find and use them. I don’t believe the manager login code would need to be changed then, since you could simple secure your manager location in whatever way you felt was best for your situation. Thoughts?

Quote from: OpenGeek at Jun 07, 2005, 03:26 PM

Thoughts?

The seperation of the Manager sounds like it would work. So no more thoughts from me

Quote from: OpenGeek at Jun 07, 2005, 03:26 PM

Ryan and I were discussing this earlier today and we are already planning to make the location of the manager configurable in an upcoming release. This will require removing all the dependencies between the two and isolating the common code where both can find and use them. I don’t believe the manager login code would need to be changed then, since you could simple secure your manager location in whatever way you felt was best for your situation. Thoughts?

Sounds good. Any idea how difficult that will be, or how soon it can be accomplished?

Just wondering whether this issue has been solved elsewhere? I’m trying to secure my manager sessions and have the same server set-up where the https document root is a different folder than the http document root, using version 0.9.6.1p2.

Thanks, hopefully someone figured this out in the past 3 years!

:)

Quote from: Bebradsm at May 15, 2008, 11:03 PM

Just wondering whether this issue has been solved elsewhere? I’m trying to secure my manager sessions and have the same server set-up where the https document root is a different folder than the http document root, using version 0.9.6.1p2.

Thanks, hopefully someone figured this out in the past 3 years!

:)

IMHO, the legacy architecture of MODx is such that it would be very difficult to achieve this without sweeping changes. And over the past 3 years, in my spare time (and Shaun’s, a.k.a. splittingred, and many other volunteers from the MODx community), I endeavored to rewrite the core of the MODx application in such a way that this, among an array of other improvements and features, could be realized and more easily expanded upon in the future without continuous rounds of sweeping changes. The result is currently in alpha testing, and will allow you to configure the manager to a location of your choice during installation.

Feel free to join the effort to help us bring this release to a stable state. See MODx Next for more...

So, any progress in this regard?

MODx Revolution definitely supports putting the manager context in a defined location, so yes. As indicated in my post below, feel free to help test the (now beta) MODx Revolution project in this regard.