The admin panel is the crown jewels
A personal site's public pages contain nothing secret. The admin panel behind them can edit every page, read every contact message, and see every order. If anything on a site like this deserves production-grade authentication, it is that panel — and "a strong password" has not been production-grade for a decade.
What runs here
Admin sign-in goes through Keycloak, the same identity provider I deploy for client platforms, with TOTP enforced — an authenticator code is required, not optional, for any account holding the admin role.
The part I care most about is where tokens live: not in the browser. The OAuth callback lands server-side, tokens go into an httpOnly session, and the browser holds only an opaque cookie. Every admin API call is proxied server-side — so a script injected into the page, the exact thing a CSP exists to stop, still could not read a token, because there is no token within reach.
Making MFA survivable for one person
Enforced MFA fails the day you lose your phone, so the setup has to be recoverable without weakening it:
- Recovery lives at the identity provider, behind the master realm — not as a backdoor in the app
- Local development can disable the TOTP requirement with an explicit script and environment flag, so day-to-day work does not burn codes
- Production pins MFA on; turning it off there is a deliberate infrastructure change with an audit trail, not a checkbox
The general rule
Authentication belongs in a dedicated identity layer, even when the user count is one. The app never sees passwords, MFA policy lives outside the codebase, and upgrading security means upgrading configuration — not rewriting login code. One person or ten thousand, the shape is the same.
Comments