I would like to implement a private, intranet-like Drupal 8 based site that is accessible via the internet but that does not show up in search engine results.

I have already researched solutions and found some promising ones, which I could combine, perhaps along with my own bespoke custom module.

I'm asking on here for the following:

  • for an all-in-one solution to consider (though, once again I stress that I am very happy to work with combining existing partial solutions along with my bespoke custom code. Just don't want to "re-invent the wheel" by duplicating what's already out there)

  • for potential pitfalls of my ideas and potential solutions (if all-in-one not available)

To expand on the non-search results requirement:

  • this private intranet site is for colleagues only to log into once conveniently but so that it doesn't doesn't need to be found via search as they will know the direct URL web address. They will already have accounts setup on the site by an administrator, with login via http auth enabled for their role.

  • this private intranet site URL web address shares the same main domain as the public site, but with a subdomain, so I would want to avoid the private site "polluting" the SEO/search results of the public site

  • by avoiding web crawlers, as well as avoiding "polluting" the main public site's SEO, the private site will not be found and hidden away from those who might be curious/hackers. Perhaps not completely able to hide, but reduces the possibility.

Intended solution

My approach to the requirement is to:

  • use basic http auth login - i.e. a pop-up login and then
  • use the REMOTE_USER environment variable generated by the login to auto-login the user to the Drupal site to be able to access the admin pages. This is a key important requirement for me to save them having to login twice 1) to get past the http auth login and 2) to then login as a user to Drupal.
  • I may restrict users who enter the site via this basic http auth way to a reduced admin role for security purposes
  • I will probably consider an additional security such as 2FA (two-factor authentication), probably send an email with a code to the user's email account. SMS could also be considered but there would be a network charge for this (either for me as a cost to bear as the provider or in reverse for the user to bear, if that is at all possible). This does reduce the convenience of logging in a little as further work by the user is required, but perhaps less cumbersome from a UX perspective than having to remember 2 logins, firstly for http basic auth, and secondly for the Drupal login. Also, the email sent would contain a different code each time so no need for the user to remember it.

My research so far:

  • security of http basic auth: Is BASIC-Auth secure if done over HTTPS? - outcome: as I am using the brilliant free Let's Encrypt generated https cert, I have https and so the passing of the user and password via the pop-up form into the site should be secure, according to this question

  • additional security - 2 factor authentication. I am aware of the existence of the tfa module but haven't tried it out yet. At time of writing it's alpha for Drupal 8. At this time, a more suitable approach would be for me to write a custom module to send an email to the user's email address.

  • specific Drupal role for users logging into the site this way. This would be straightforward enough to do via custom module code, to check for the role in the user.

  • implementing the basic http-auth itself: this is simple enough to do via the web server vhost or .htaccess config (apache, nginx) but I am aware of some Drupal modules that also do this and therefore might offer convenient control rather than having to manage via logging in as root admin to server. Modules I am aware of are:

  • webserver_auth - close to what I want (I think it logs the user into Drupal via http auth) - there is a Drupal 8 dev version at time of writing

  • http_auth_ext - again close to what I want but seems abandoned, but worth studying for my own custom implementation

  • securesite - very close and perhaps better documented than the others

  • https://www.drupal.org/sandbox/dsnopek/2135005 sandbox project, worth studying

  • basic_auth - worth studying but perhaps not quite what I'm looking for, part of Drupal 8 core

  • http_auth - looks similar to basic_auth, wondering if it duplicates that or does something different. Does look like it provides basic http auth without the need for web server vhost configuration

closed as too broad by leymannx, mradcliffe, Alfred Armstrong, Yusef Mohamadi, DRUPWAY Dec 11 '18 at 4:59

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Voting is anonymous by design. Knowing the users who vote posts doesn't give any helpful information on what needs to be rephrased in the question, if there is any missing information. – kiamlaluno Dec 2 '18 at 18:24
  • 2
    The fulcrum of the question is essentially: I'm asking on here for an all-in-one solution to consider (though, once again I stress that I am very happy to work with combining existing partial solutions along with my bespoke custom code. Just don't want to "re-invent the wheel" by duplicating what's already out there). I take somebody saw the question as not showing any research effort, being unclear or not useful (to future users). There is no need to leave a comment saying what the tooltip already says. – kiamlaluno Dec 2 '18 at 18:33
  • 1
    I vote to close this question as way too broad. Although I can see you put quite some effort in it. Now after your research is done it's up to you to make a choice and to get something up and running. And once you are stuck, please come back with a reproducible problem and ask a narrow and specific question. – leymannx Dec 2 '18 at 18:53
  • +1 upvotes both kiamlaluno and leymannx for both your inputs as I appreciate your time looking at the question. Yes I will try to come back with an answer to this question as I have done in many instances in the past. I can see the viewpoint that the question needs to be more narrow and specific as stackexchange family question sites aim for a question that can yield definitive answer rather than. Sorry for the frosty initial comment. I appreciate the anonymity affords freedom of expression, so not really cowardly - sorry. Thanks for coming forward. – therobyouknow Dec 2 '18 at 21:14

You can do this simply with the require_login module. This will also work with the tfa module if you want that. If you have areas that you don't want to secure, you can specify them in the settings.

It will prevent search engines from getting your info. But you probably also want to have a static robots.txt file that tells them not to try to index. There is a robotstxt module if you want to manage this via the GUI.

Not the answer you're looking for? Browse other questions tagged or ask your own question.