How to restrict access to a web application to authorized devices only?

Question

I have developed an MVC web app. Right now, the client using this app in office area. The client has requested that no one should use this app on any device except the office's PC/tablets.

Now problem is, it's a web app, so how can I put restrictions that nobody can use this app from the outside of the office or with devices other with than office's PC/Tablets?

Answer 1

There's a couple of things you can do to help restrict the use of the application to a specific office location and specific devices, although as other answers point out none of them are absolute protection

• Setup a firewall in front of the application to restrict the IP addresses allowed to access the application to the clients external IP address range. Most companies will have static IP addresses on their Internet facing routers and if you set the application only to be accessible by those IP addresses it would be harder for an unauthorised person to get access to it unless he is in their office. TBH this sounds like the approach that will work best for your customers requirement
• You could also use client Certificates on authorised devices. As @adnan points out it may be possible to move those to another machine but that would require the attacker to either be a staff member of to have unuthorised access to one of their systems
• perhaps as a detective control you could combine this with browser fingerprinting (e.g. panopticlick ). Create a list of devices and their finger print, then if the client cert is used on a device which doesn't match the fingerprint you can block it.

As I say these aren't absolutes but then nothing in security is. If all your customer is looking for is to stop people from outwith the company seeing their site, I'd go with the source IP address filter approach.

Answer 2

You just have to host the web app on a server on the intranet that is not connected to the internet.

Proper routing and firewall measure should ensure that no one that is not connected to the local network has access to the web app.

If people outside the network needs access to the web app, have them setup a VPN connection to your local network.

Answer 3

How secure do you need to go?

This is probably as "secure" as you can make it. It's not technically safe. As Rook said, there are still things here than can be exploited. These are a few steps you can take to try and harden the system:

1. Setup the web server on a physical server on the office LAN. Do NOT use NAT to connect any outside traffic to the webserver. If the server is used for other sites they should be on a different server or VM.

2. Setup an SSL VPN firewall (Cisco comes to mind). Cisco has apps for iPads that can be used to setup a "secure" tunnel with the router.

3. Once you've authenticated via VPN (remotely) you would assign a local IP address within a certain specified range (this depends on the number of clients connecting to the server). Depending on the router you can assign rules. Because you can't control the network on the other end of the VPN (let's say the user's home network) then this is a potential attack vector.

4. Local traffic and VPN traffic would need to have different IP ranges for tracking. Local traffic should have static IP addresses assigned by MAC address (spoofable) by the DHCP server which are all logged. This will help you check for collisions and spoofed IP addresses and MAC addresses.

5. On the firewall on the webserver you would setup a subnet of addresses that can connect to the web server. This would include the VPN range assigned in the router for the users and the whitelisted internal static IP addresses.

6. Then on the web server itself you can restrict access to the website via the whitelisted ip addresses (IIS 7 and Apache) you've setup in the DHCP server and in the local firewall (this is redundant in the event someone finds an exploit for altering iptables in a *Nix box).

If you use a corporate after market software firewall like Kaspersky (on a Windows or Linux box) you can block traffic that way too.

To make changes to this system: 1. the ip address lists would need to be updated on the internal DHCP server 2. in the webserver's firewall 3. and in the webserver config

So that "locks down" the access to the actual web server...

Next you'll need to run SSL on the webserver and require a specific username and password for the user. The password should be at least 16 characters.

Once the user authenticates on the webserver, then you would send them a message, either via SMS or e-mail that contains a single-use or one-time password that allows the user to be whitelisted for some set amount of time on the server. (If anyone has access to the user's cell phone this might be compromised). If the user closes the browser window they have to be reauthenticated (and this should terminate the session). You can set a keep-alive script that runs in a language like Javascript that expects a transmission from the client within a certain range of time. If the client doesn't answer, then kill the session. (This prevents disabling javascript for access. Also it helps with people closing their browsers and trying to open new sessions before their old session has expired.) They should only be able to login from one location at a time.

You should prevent the user from storing their passwords on their devices. (This can be bypassed with plugins in browsers like Firefox.)

To make things more strict you could even go as far as requiring the tablets to login to a virtual terminal via something like VNC or RDP (Not ideal on a phone). Then they would have to use the web client on the virtual machine. This VM would be restored to clean on the next run or connection.

Anyone who knows the system can exploit it. Anyone outside the system would have to spend a lot of time trying to get in and they would need to know the system existed.

All aspects would need to be documented. If someone had the documentation they could try to find a weakness in the system.

Again this comes down to people. Anyone with access to the information over time could store copies of all of the information (screenshots with a cell phone, texted PDFs of office documents, etc.) SSL is also crackable, so even encrypted "secure" connections can be read by the right people.

Answer 4

What you're trying to achieve is not possible. HTTP isn't designed to provide hardware-specific identifiers, the only "identifier" is the User-Agent which isn't identifying at all, and it can be spoofed, so the browsers don't even access that information.

Even with a client certificate, it just can be exported from the browser to another device.

Tell your client it's not technically possible.

Answer 5

Who owns the code? How likely is it that someone else would want to use the app? How serious would the consequences be if someone else used the app? What types of device? Is the access to be restricted to static IP addresses? These are just some of the questions you should have answered in your post before asking for design recommendations.

VPNs IP addresses and client certs have already been mentioned, but client certs can be tricky to install on some devices. Static IPs are only going to work within a well managed LAN. A VPN would require tight integration between the server, network and application config.

Storing a simple token in a persistent cookie (without appropriate permissions and process around the device registration) is a simple solution, but not very resistant to reverse engineering/spoofing.

Answer 6

Solution Number One If you are using IIS, it has built in service where you can restrict access of your application based on IP Address.

Solution number two :Try to implement Terminal locking which requires programming;

You can implement the Terminal locking solution which is hardware-specific identifiers. Please follow below steps.

Note: You have to set Static IP for each Device.

• A: Use Active-x controls to capture MACAddress information at client side, i have implemented only for Internet Explorer. To add more security you can capture MACAddress, IPAddress and computer name. please note Unsigned Active-x and signed active x must be enabled in the browser.
• B: At application level the same thing has to be implemented to read the information from step A and store/verify the information passed in the database.

• C:At database level please follow below steps;

• Step 1: When application is accessed for the first time, system must capture the IP address and store it in a table e.g. please create a table with the name dbo.Terminals and through your application try to read and store IP address and generate A unique ID for Each IP automatically. This table must contain some fields with the name MACADDRESS and additional fields for users mapping against this UNIQUE CODE e.g. user1, user2, user3 and so on.

• Step 2:Now, modify your dbo.user table and add field with the name Static Terminal-applicable which will work as switch (On/OFF)

• Step 3: User Login: Write some codes to check if step B is ON. If yes, then check if terminal is allotted Step A. now check if this terminal is having registered users list (see step A user1, user2 etc). finally check that macaddress is capture and available in dbo.terminals, if not captured then get and store in the database. The above solution is tested in many banks, which is device based access to banking domain and financial service systems.

Answer 7

you need set up an identity-aware proxy in front of your application, i.e. https://cloud.google.com/iap/docs/enabling-on-prem-howto there are number of steps required such as extra VM in the cloud; alternatively, use fully managed service such as https://gw.run with zero setup required.

Answer 8

It can be done, (like some users answered already) if you are using IIS you can block access from certain IP's or all IP's and then give access to only the IP's / range of IP's that you want to access the web app.

On another hand, there are some pretty good security models for php where you can block an IP from connecting straight to your web app.

This is what I did, you can slap a firewall in front of your web app, put your web app on a port that's not port 80 then block access to it from the firewall, THEN, install a vpn in your LAN and on the office's devices, so, if a user wants to connect to the web app from an external location he / she will have to grab an office device and login through the vpn, and install that vpn ONLY on the office's devices (you enter the password), complying with what your bossed asked for, to only connect using your office's devices.

Just for kicks, or to prove to your customer that it works, you can enable your application to log the username and IP used to login to the application.

Something in the likes of this is what you would see, I got this from my MySQL server log for a certain web app:

id, datetime, editdatetime, ip, user, table, action, description

70941, 2017-05-12 16:06:27, 2017-05-12 09:06:27, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys id : 96846 ---Fields Int Stat [old]: Int Stat [new]: 4

The log is telling me that the user jenxxx logged in from 24.153.197.xxx (external ip) and edited the registries with the id's stated after the keys id section and the changes she made.

This is from a php / mysql web app, and I can add a restriction for the user to connect using ONLY certain IP from 8 am to 5 pm and Monday through Friday only, and that goes embedded into the web app's security feature, even IE would be able to pick up these information from the device and / or the server itself.

It can be done, it just takes a little bit of work.