I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users.

The API we're using allows users to whitelist IP addresses that can use their API keys. I was thinking of telling our users to whitelist the app's IP address in order to add a further layer of security, so that only requests coming from our IP address would be allowed.

But I've read it's fairly easy to spoof IP addresses and considering I'm going to be telling our users what IP address to whitelist (meaning, a bad actor wouldn't have to work too hard to see which IP addresses are valid), I'm wondering if this is even worth the effort?

If a malicious actor were to somehow get their hands on the users API keys, would IP address whitelisting really add any meaningful layer of security? Or would this just be a minor inconvenience at best for the bad actor?


1 Answer 1


But I've read it's fairly easy to spoof IP addresses

This is where you are mistaken. It is easy to connect to a website so it sees an IP address that is not your own by routing through a proxy server, but you cannot spoof an arbitrary IP address. For the TCP protocol, which is in all likelihood what you are using, it is simply impossible to spoof an IP address without compromising a large portion of the very backbone of the internet itself.

The reason for this is that TCP uses a handshake to establish a connection. First, the client sends a SYN packet. The packet contains the source IP. The server then responds to the specified IP with a SYN+ACK packet, after which the client finally sends out an ACK. While it is technically possible to spoof the source IP, it would result in the server sending the SYN+ACK to the spoofed source address which, naturally, wouldn't be expecting it and would refuse the connection. Because traffic can only be sent after the handshake is completed, only genuine source IP addresses will work.

would IP address whitelisting really add any meaningful layer of security?

If an attacker who has stolen the API keys can only use them to log into your service, then whitelisting your IP does not provide any security improvements. After all, an attacker will connect to the whitelisted address in order to (ab)use the stolen API key anyway. If instead the worry is that the attacker will create a false copy of your site (e.g. an MITM attack) and attempt to get your application to send the API key to them, whitelisting the address will still not help. Instead, you should use TLS for all communications and hardcode the TLS fingerprint in the application. That way, your clients can be ensured that the application will refuse to connect to a non-genuine server.

  • If I I'm understanding correctly, API calls that come from a spoofed IP address would be refused due to the way TCP protocol works? If this is the case then I think whitelisting should actually add a lot of security, since only my app with the correct IP address will be able to make those API calls on behalf of my users. I'm a bit confused by your last paragraph however. I'm not sure what you meant by "use them to log into your service" and also "connect to the whitelisted address".
    – phil917
    Commented Aug 4, 2018 at 9:03
  • @AntiWiggin Perhaps I misunderstand your setup. Are you talking about whitelisting a client application's IP address server-side, or whitelisting the server's IP address client-side?
    – forest
    Commented Aug 5, 2018 at 1:42
  • I meant the client will be whitelisting my app's IP address from their end when they create their API keys. They will then enter their API keys into my app which perform calls on their behalf.
    – phil917
    Commented Aug 5, 2018 at 7:39
  • @AntiWiggin Ah, yes, then whitelisting can improve security.
    – forest
    Commented Aug 6, 2018 at 21:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .