How can I reliably/securely tell if the user visiting our website is coming from inside of the corporate firewall? Is verifying the IP address enough?
I think a bigger concern is "can you write this code in such a way nobody could manipulate it?" I very much doubt it, however, there are things you can do.
Edit Ok, old answer was probably being a bit security paranoid here. Introducing debug code into your live app is a security risk because it's another level of authentication you need to definitely stand up to scrutiny. However, in certain scenarios, that might be acceptable.
In the case of an online store, I could say the best option is client side SSL certificates signed by a trusted certificate the server knows about, possibly combined with IP address restrictions. Keep a revocation list Reasons for this:
- Pretty hard to spoof. The certificate has to be signed and authorised by you first and installed into the client browser. Thus security becomes controlling access to authorised certificates - you can invalidate them server side by keeping a revocation list/whilelist of trusted "I will show profile information to"
- You're using SSL anyway in the slowest case (logged in user) therefore you can assume SSL-based traffic times are upper bounds (plain HTTP will be faster, but only marginally).
- Rely on existing crypto implementations rather than attempting to implement something new that might possibly be broken cryptographically speaking.
- You could actually relax the IP requirements to a certain extent; developers can test from home too.