Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.

Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.

That's a normal HTTPS cert, I'm talking about this:

http://www.ibm.com/developerworks/lotus/library/ls-SSL_clien...

Really, though, unless you're extremely security-conscious, a hidden URL over HTTPS with a good password is sufficient for your purposes.

Also, don't serve any pages over plain HTTP, login pages even less so.

Thanks, I guess I ll explore the option that you described above. Also there is one more thing I am curious about, so heroku does gives a free SSL certificate but that only works for their domain meaning something like truffleapp.herokuapp.com, it doesn't work for the custom domain. Do you know any way where I can save money on buying SSL certificate and rather use heroku's certificate. All the certificates put atleast a 1000$ hole in the pocket but eventually in a week or so if I can't figure out how to use heroku SLL, I have to spend that money

If you are just using ssl on your admin site; you could roll your own.

  openssl req -new -x509 -nodes \
        -out /nuxeo/certs/server.crt \
        -keyout /nuxeo/certs/server.key \
        -batch

you will get a warning about the certificate being suspect; but at least the traffic will be encrypted

StartCom offers free SSL certificates that are recognized by most browsers: http://cert.startcom.org/

Heroku will still probably charge you a basic fee for enabling SSL, since each certificate requires a dedicated (non-shared) IP address... at least until SNI support becomes more commonplace.

Edit: Just to reiterate what others have said, this is a server-side certificate, which is primarily used for encryption. You'll also want to generate a client-side certificate for authentication purposes. That's something you'd do entirely on your own, no need to go through a third-party CA for that.

Note that StavrosK is probably talking about SSL client authentication, which isn't what most people think about when talking about SSL. Basically, it enables you to allow access only to people with a certain client certificate installed in their browser (i.e., proving the clients' identity to the server, not just the other way around).

Unfortunately I have no idea how this would work on Heroku.

There's a great article about client authentication for HAProxy (might be interesting even if you're not using HAProxy): http://blog.exceliance.fr/2012/10/03/ssl-client-certificate-...

There is a module for django to do client ssl cert authentication. I haven't used it though but it seems maintained.

https://github.com/kimvais/django-ssl-client-auth

you can also put up a htpasswd if you can on that directory, every bit helps.

tbh , was not aware of creating private ssl certificates for this purpose .. Thanks

Limit access in the firewall/load balancer/webserver to whitelisted ip addresses. If you don't have static ips at your office or a vpn, include the ip of a VPS or dev server, and use ssh forwarding (-D for a socks proxy) to access the admin site. And if you're running everything from one server, you can even limit connections to localhost and tunnel connections through there.