How to secure admin login?

Question

PHP

Hello.
How can I secure the admin panel?
I haven't done any serious projects before, so I don't know.

I make the front on react, redux, react-router.
Server in php, for requests I use pdo.

Now the entrance to the admin panel is implemented as follows:

In the address bar, I add /admin to the path,
There is a login form, ... I
check the user status, if it is root or admin, then I change the redux state, change isAdmin to true.
And all if isAdmin is true I have access to the admin panel.

I don't think it's worth it, but I don't know how.

Answer 1

ravshan selimov ,

isAdmin from redux state

I check authorization on the server,

Store the user's state in the session, not in redux, although you can duplicate it in rdux. On each request, check the session for the current state of the logged in user, check whether he has the right to access the desired controller / script. For a more confusing login, you can attach some other key to the admin panel, for example /admin?key=666 and check for the presence of this key, otherwise send it to 404.

Answer 2

Each request to the admin panel on the server must be made through auth middleware, and the authorization token must be checked. Are you using any framework for php?