Ok, I saw this on an earlier answer:

Blockquote

Will never be possible! This question has been asked over 9,000 times, and everyone who asks it doesn't understand even the most basic concepts of

Blockquote

security. – rook May 18 '13 at 5:55

And, sorry Adi:

Blockquote

What you're trying to achieve is not possible. HTTP isn't designed to provide hardware-specific identifiers, the only "identifier" is the User-Agent which isn't identifying at all, and it can be spoofed, so the browsers don't even access that information.

Even with a client certificate, it just can be exported from the browser to another device.

Tell your client it's not technically possible.

Blockquote

And I do need to say it ... It CAN be done, if you are using IIS you can block access from certain IP's or all IP's and then give access to only the IP's / range of IP's that you want to access the web app.

On another hand, there are some pretty good security models for php where you can block an IP from connecting straight to your web app ( I would still go with the IIS or Firewall solution).

Furthermore, you can slap a firewall in front of your web app, put your web app on a port that's not port 80 then block access to it from the firewall, THEN, install a vpn in your LAN and on the office's devices, so, if a user wants to connect to the web app from an external location he / she will have to grab an office device and login through the vpn, and install that vpn ONLY on the office's devices (you enter the password), complying with what your bossed asked for, to only connect using your office's devices.

Another point, you can enable your application to log the username and IP used to login to the application, that way you will have prove that it works.

70941, 2017-05-12 16:06:27, 2017-05-12 09:06:27, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys id : 96846 ---Fields Int Stat [old]: Int Stat [new]: 4

70942, 2017-05-12 16:06:27, 2017-05-12 09:06:27, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys id : 96852 ---Fields Int Stat [old]: Int Stat [new]: 4

70943, 2017-05-12 16:06:27, 2017-05-12 09:06:27, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys id : 96312 ---Fields Int Stat [old]: Int Stat [new]: 4

70944, 2017-05-12 16:06:27, 2017-05-12 09:06:27, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys id : 96203 ---Fields Int Stat [old]: Int Stat [new]: 4

70939, 2017-05-12 16:06:26, 2017-05-12 09:06:26, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys id : 96828 ---Fields Int Stat [old]: Int Stat [new]: 4

70940, 2017-05-12 16:06:26, 2017-05-12 09:06:26, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys id : 96841 ---Fields Int Stat [old]: Int Stat [new]: 4

It can be done, (like some users answered already) if you are using IIS you can block access from certain IP's or all IP's and then give access to only the IP's / range of IP's that you want to access the web app.

On another hand, there are some pretty good security models for php where you can block an IP from connecting straight to your web app.

This is what I did, you can slap a firewall in front of your web app, put your web app on a port that's not port 80 then block access to it from the firewall, THEN, install a vpn in your LAN and on the office's devices, so, if a user wants to connect to the web app from an external location he / she will have to grab an office device and login through the vpn, and install that vpn ONLY on the office's devices (you enter the password), complying with what your bossed asked for, to only connect using your office's devices.

Just for kicks, or to prove to your customer that it works, you can enable your application to log the username and IP used to login to the application.

70941, 2017-05-12 16:06:27, 2017-05-12 09:06:27, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys id : 96846 ---Fields Int Stat [old]: Int Stat [new]: 4