I'm relatively new to web development and security and I'm looking to limit the access to my web app to specific companies (and/or IP addresses).

Authentication at the user level via username and password is not an option. I could set up a firewall and only allow traffic from certain IP addresses, but this doesn't seem like the most secure solution since someone could just spoof the IP.

Is there an auth pattern that would be able to handle this case? The end result would have all users belonging to a given organization having access to the app. Use a certificate or something like that?

  • 1
    Spoofing the IP address in a TCP connection is harder than you think Apr 30 '18 at 19:08

IP Spoofing is hard. Very, very hard. You can hardly send a couple bytes on a simple protocol using IP spoofing, let alone requiring an answer/response.

Imagine talking to someone, but only being able to speak to them, and not listen to them. IP Spoofing is like that. You must predict all their answers (on protocol level) and give credible answers without ever receiving anything from them. It's not easy at all.

Your main problem is not that is easy to spoof IP (it is not), but that is easy to attack someone at those companies and use their computers as a proxy. A phishing email will end up with someone there executing a program from someone outside, and create a tunnel between the attacker and your application. Unlikely, but way more likely than a IP spoof.

You can safely use an IP whitelist, and only allow people from that list. Usually companies will have a gateway server (and proxy, and IPS/IDS, and virus scanner all in one) and every request will come from this gateway. So it's simple to create such a list.

You said login/password is not an option. Why?

  • Thanks! This is of great help. My preference would be to use a username/password login but the requirements that have been laid out specify that this is not an option. Apr 30 '18 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.