Ready for Go-Live Case Study

The Business Problem

The map service started life as a private tool behind the LM3 Hub, and its test pages were never meant to face the public. Opening a demo to anyone meant thinking again about who could reach what. Some services could be called from any website, one of which spends money on a paid lookup service every time it is used. There were no limits on how often a visitor could make requests, and the developer test pages would have gone public alongside the supplier pages.

The Solution

wildesoft.net carried out a security check of the public pages and the services behind them, and listed every finding with its severity and a recommended fix. The fixes chosen were then made:

• the old test page was removed, and the map service now only accepts browser calls from the LM3 Hub
• the live site serves only the supplier pages, with the developer tools kept to development
• visitors' requests are rate limited, and the search caches have size limits so they can't be used to fill up the server's memory
• security headers protect the pages from being embedded or misused by other sites
• errors on the live site return a plain error response, with no internal detail

The site was also moved onto the latest version of .NET, given automated tests that run against a real copy of the database, and given build and deploy scripts for each of its three parts. A plan was written for placing it behind Cloudflare, which adds a check on every visitor and keeps the server itself out of direct reach.

The Result

Deprivation Lens can be opened to the public with its paid lookups, its data and its server protected. Every finding and fix is written down, so the same checks can be repeated before a login and real client data are added.

See all case studies for Deprivation Lens