PHP IP check as security?

Question

Would just like some input on a PHP script I'm writing. It's just a simple script that only myself should be able to access. I don't have a dynamic IP address, so this isn't an issue for me, but I'm wondering if there's any potential problems in my "security" measure.

Currently my script is setup like this:

$uip = $_SERVER['REMOTE_ADDR'];
if ($uip == "my personal ip here")
 {
   echo "access granted";
 }

else
 {
   echo "access denied";
 }

Is this "safe"? Or is it easy for somebody that knows my IP to be able to spoof their visit to the PHP script using my IP and trick the script into thinking it's my IP?

Any suggestions? I don't want to over-complicate things (in example a login page) and just want to know if my KISS solution is viable or potentially problematic.

Answer 1

The biggest risk with this setup is Cross-site request forgery (CSRF). As an example, imaging a site has a URL like http://mysite.com/setTitle?title=Hello which sets the site's title. You only want the admin to access this, not anyone else, and you use IP address controls to enforce this. Now just imagine if the admin is browsing some unrelated site, and that includes an image tag which links to this URL, e.g. http://mysite.com/setTitle?title=Evil What will happen is that the admin'd browser will try to load that link. The web server will see the request coming from the authorised IP address, and allow the title to be changed. Not good! The usual fix for CSRF is to issue a random token to users, which must be included in the request.

Who else uses your IP address? Most home setups have a number of people accessing the internet through the same router, and hence the same IP address. You may not want these other people to have access.

The risk of IP address spoofing is less of an issue. TCP has reasonable protection against this, which stops many attacks. It is still possible in certain circumstances, but if you're just after something simple, I wouldn't worry too much about it.

Answer 2

Unfortunately, I don't think this is a very secure approach. There are a number of reasons why:

1. NAT in your local network
2. NAT at your ISP (Carrier-grade NAT)
3. Proxies anywhere between your browser and your web server
4. Load balancers in front of your web server

Any one of these may result in multiple devices accessing your page to share the same IP address.

In case you're not familiar: Network Address Translation (NAT) allows multiple systems on a network to access the Internet from the same public IP address. This is necessary because there are far more systems accessing the Internet than there are public IPv4 addresses available.

Most households run a router which performs NAT for them, meaning any system connecting to the Internet (e.g. your desktop, laptop, tablet, phone, television) will come from the same IP address. That also means that any one of these systems can access your web page, and will be authenticated.

It gets worse than that. Your ISP could be running Carrier-grade NAT (CGN) - which means that a whole bunch of households will share the IP address as you. That means that any one of them could access your web page, and will be authenticated.

Then there are proxies. If your browser sends traffic through a proxy (such as one hosted by your ISP), or your website sits in front of a content delivery network (CDN), then you will most likely get the IP address of the proxy or CDN edge node, rather than the IP address of your computer.

Finally, if your web host has a load balancer in front of your web server, then you may end up with the IP address of the load balancer.

For all of these reasons, I would definitely not recommend a login mechanism which relies solely on the IP address of the user accessing your web page.

If you don't want to write the code for authentication yourself, then I would recommend checking out some third party libraries for doing this - though be sure that you review the code before implementing it into your web page.

In regards to IP Spoofing

Others have mentioned the risk of IP spoofing, which sounds easy in theory, but (even in a simplified form) it would require two different steps:

1. Change the IP address in the header of the IP datagram
2. Intercept the response from the server to read the results

The first bit is not difficult by itself. The difficulty is that the server will send the response to the spoofed IP, rather than the attackers IP. In order to read the response, the attacker would therefore need intercept the response to the user. This would generally be quite difficult.

Answer 3

You basically answered your own question. No, it's not safe if it is used as the only security measure.

An IP is public, and an IP can be spoofed, so people can access material easily by spoofing your IP.

I really do suggest a login page as main layer of security. Here is a website that has simple and effective tutorial on how to make a login script. It's something really good to know, or at least understand.