3

I've developed some software installed e.g. on www.example.com. It's accessed via an HTML web page. Some HTML buttons can call PHP end points which are also on that domain. I use JWT to secure login.

But what want to do is only allow access to the end points from the office, so I'm trying to get the PHP to block any access from other domains.

I tried

header('Access-Control-Allow-Origin: https://www.example.com');

but it doesn't block the end points when I try to access thehm via the www.example.com domain web interface.

Maybe instead I have to check the client IP within the PHP and deny access if it doesn't match. But what if there's dynamic IP's and the IP's could change given enough time. Is there a way round that?

Any help appreciated.

  • 1
    Your question is quite unclear to me... People visit www.example.com. This will make requests to your webserver, both for static files (HTML), and your PHP endpoints (the user clicks some button specified by said HTML). Who exactly do you want to block? Do you only want to allow people from your office to visit your site? – marcelm Sep 3 '18 at 22:53
  • @marcelm yes, I want it to be hosted on my clients server for convenience and to use a database on the server, but only allow use by the office IP address. I solved this by setting up a '.htaccess' file in the root '/projects/' folder which contains all the PHP and HTML files. I wanted to protect the end points in particular. From the accepted answer I was able to discern this solution. It's very simple and works. Occam's Razor for me :-) – Pixel Sep 4 '18 at 5:09
5

First, regarding what you have tried already:

header('Access-Control-Allow-Origin: https://www.example.com');

This will fail for a number of reasons:

  1. This a client-level control that doesn't stop anyone from making requests to your endpoint anyway. This is, in fact, a flag for CORS in a browser, and isn't actually relevant to your use case. It would not have any impact at all with your current setup, nor would it even necessarily stop people from accessing your API endpoints even if they were on another domain (CORS is a read restriction, not a write restriction).
  2. As you allude to, even if this worked as intended, it would not actually do what you want, since it would stop people from using your endpoint from within a browser on a different domain, but that would not actually lock it down to your office at all
  3. It also wouldn't work anyway because regardless of what headers you pass back any non-browser client can ignore your headers and just do what they want. I.e. a browser will listen to CORS restrictions (because that is how browsers work) but I can hit up any endpoint I want with curl, postman, or any other http client and do whatever I want anyway. It's not just browsers that use the internet, so you can't make any assumptions about who is browsing your site how.

IP Filtering

In a case like this the best bet is to simply filter by ip address, which you mentioned. Generally offices have static IP addresses or change rarely, so it is actually quite feasible to do. Presuming the entire office is NATed behind one router/ip address then it is quite simple because you just need the one rule: dump all traffic except port 80 (443?) coming from the office IP. You probably shouldn't bother doing this with PHP, however, because for PHP to reject the request on the basis of the IP address first requires your server to process the request, launch PHP, and pass it along. A simple firewall rule is much easier on server resources. Dynamic office IP addresses are almost unheard of, so unless you know that that is the situation for you, I wouldn't worry about it.

  • Thank you. I had my reservations about Access-Control, as I'd read it was not designed to restrict access, or something like that. I will give IP filtering a go from behing the firewall. Ideally I would need to filter only a portion of the domain, e.g. https://www.example.com/projects/ – Pixel Sep 3 '18 at 13:45
  • I may be able to achieve this by creating a .htaccess file in my /projects/ server folder (possibly) – Pixel Sep 3 '18 at 14:51
  • 1
    You probably can, and it will get you slightly performance than with PHP, although not necessarily as much as you think. Apache loads up the PHP interpreter for every request, so your footprint is still large. However, that isn't me saying that is a bad idea. For small applications server resources are rarely a problem, so using .htaccess or even PHP are unlikely to cause you actual problems. – Conor Mancone Sep 3 '18 at 15:50
  • resources aren't really a problem, but this is something to bear in mind for future work. – Pixel Sep 3 '18 at 16:05
3

Your idea on the domains is rather wrong. You need to understand one essential thing about a web server.

There is no such thing like "an access from a domain". It is not a "software" which is sending requests to endpoints but a client (which is usually a browser). A client may read some information from your server first, but it's unnecessary.

Long story short, you cannot limit an access to your endpoints "from a domain".

The idea for the ip address is more fruitful, and more plausible than you think. Offices seldom change their IP, least they use a dynamical one. So you can limit access to the whole www.example.com server (not only endpoints) based on the IP address of your office.

Though there is another culprit, as IP address can be forged, and thus it is possible to create a request that will be allowed to send something to your endpoint (however without the ability to get the response).

But I would consider such a protection rather unnecessary given you are using JWT for the authentication (and, I assume, HTTPS for the secured connection).

  • Thank you. Yes, I knew my understanding of the basic principles was incorrect. I am using SSL/TLS for communication and JWT for authentication, but my client is requesting I block access from outside their IP. – Pixel Sep 3 '18 at 13:45
1

Ok, this is how I solved the problem:

In your server's File Manager, in the folder you wish to restrict access, create a new .htaccess file and add the following lines:

Order Deny, Allow
Deny from all
Allow from 1.2.3.4

where 1.2.3.4 is the IP address you wish to allow.

You can grant additional access by comma separating IP addresses or if that doesn't work just use additional Allow from lines.

I believe you can also add wildcard IP addresses too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.