Security & DNS¶

Securing Socon-MKT requires a multi-layered approach that protects both the infrastructure layer at DigitalOcean/Cloudflare and the application layer within Django.

---

1. Application-Level Security¶

• API Key Protection: Every REST API endpoint on the backend is strictly protected. Client requests must include a valid API key in the headers to interact with the database. Unauthorized requests are immediately rejected by DRF permission classes before hitting the core logic.
• Admin Panel Isolation: The default Django Admin panel (/admin) is locked down and restricted to authorized superusers only. Standard users cannot access this portal under any circumstances.

2. Infrastructure Security¶

• Cloudflare DNS Proxy: The backend subdomain (mkt-api.socon-mkt.com) is proxied through Cloudflare. This hides the actual IP address of the DigitalOcean droplet, preventing direct DDoS attacks on the origin server.
• Header Sanitization: As seen in the Nginx configuration, we explicitly force X-Forwarded-Proto https and clear out contradictory SSL headers. This ensures Gunicorn processes requests securely and prevents header spoofing attacks.
• UFW Firewall (DigitalOcean): The server's internal firewall is configured to block all ports except those explicitly required by Nginx and SSH.

  sudo ufw allow 'Nginx Full'
  sudo ufw allow OpenSSH
  sudo ufw enable