CODEWITHSUNDEEP
asp.netsecurity
Chibuzo
Chibuzo

Reputation: 6117

Restricting access to IP addresses on a web application

I'm working on an application that will be used from different locations so it has to be on a network, and since the distance from each workstation that will use the application is quite far, it will be on the internet. Definitely on a dedicated Windows Server.

I have security concerns because it is such an application that black-hat hackers and crackers will like to abuse to their own ends.

So I'm thinking, I can (since I am the I.T head of the company) procure a static IP address for all the workstations that will use the application, then I can compile a white list of IP addresses. If a request is not coming from an IP address in the white list, the request will be denied. Does this make sense?

I could also use more security tips on securing the server and the application. It's an ASP.NET MVC application.

Upvotes: 1

Views: 382

Answers (1)

Aurand
Aurand

Reputation: 5537

Does this make sense?

At a network level? Somewhat. At an application level? Probably not.

IP filtering is something that makes sense at the network level. So setting firewall rules to dictate which IPs are allowed to access certain ports on a server. That is both sensible and common.

Trying to do the same thing at the application layer is error prone and problematic. For instance, if your application is behind a load balancer, the IP address your application sees may well be the one belonging to the load balancer, not the client who originated the request.

As an additional note, just because a request is coming from a trusted IP, doesn't mean that you don't have to be careful. Your "trusted" client systems could be compromised or an attacker could be using a CSRF attack.

Upvotes: 3

Related Questions