Let's say there is an application that has IP whitelisting, all other IP's are denied. This check takes place on three different locations:
- PHP script.
Now in what OSI layers does those three locations fit? I guess something like:
- iptables layer 3 or 4,
- .htaccess layer 5,
- PHP script layer 7.
I recently saw a case wherein this was applied. Why would someone do this and what are the advantages and disadvantages of doing so? And can one or all of this methods be bypassed with some kind of IP spoofing?