3

I am planning to create a system, but I still have some questions about security. I would like to know if it makes sense to block unauthorized users from accessing the system, through the ip, using a PHP script and also firewall rules by AWS EC2, would this be good practice to prevent unauthorized users from accessing the system?
My biggest fear is to compromise the system

PHP sample code

<?php

class RemoteAddress
{
    /**
     * List of trusted IP addresses
     * 
     * @var array
     */ 
    protected $trustedIPs = array('127.0.0.1', '192.168.0.101', '192.168.0.102', '192.168.0.103');

    /**
     * Returns client IP address
     */
    public function isDefinedIpAddress()
    {
        $ip = $_SERVER['REMOTE_ADDR'];
        if(in_array($ip, $this->trustedIPs)){
            $this->returnPage();
        } else {
            $this->returnErrorPage();
        }
    }

    /**
     * Redirects the user to the success page
     * The user will be able to access the website
     */
    private function returnPage() 
    {
        header('Location: index.php');
        exit();
    }

    /**
     * Redirects the user to the error page
     * The user will not be able to access the website
     */
    private function returnErrorPage() 
    {
        header('Location: 403.html'); //We can display an forbidden message maybe...
        exit();
    }
}

$object = new RemoteAddress();
$object->isDefinedIpAddress();
New contributor
Anne Batch is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
6

PHP offers great opportunities to mix configuration data, business layer code, HTML and javascript in the same script. Yet IMHO it is not a good practice, because it tends to make writing and executing tests harder.

Here the list of allowed IP addresses is a configuration data. Having to search such data through the code if you later install the application on a different system with different allowed address is not maintainer friendly.

For the point whether IP addresses control should reside inside or outside the application, it is largely a general design decision. Either you specify that the app will not worry for IP security, and it should be protected with a firewall, or you want the app to have as few external configuration as possible and you keep it inside. The first way better respects the single concern principle, but requires a proficient firewall admin. The second way is probably less versatile, but the application will run anywhere with a minimal external configuration. Different use cases and a different public target.

5
  • Sorry to ask, but are you saying that the most correct would be the firewall form? – Anne Batch Feb 22 at 16:10
  • 1
    No I am not. It would be the way to go to install an application on a large corporate datacenter, because the firewalls and their admins are already there. But if you want your 12 years old cousin install it on their PC, then I would not even speak of firewalls... – Serge Ballesta Feb 22 at 16:13
  • Haha. Well, thanks for your help – Anne Batch Feb 22 at 16:20
  • @AnneBatch: I am sorry but I am not really comfortable in chatrooms. Maybe too old for that :-) – Serge Ballesta Feb 22 at 16:31
  • 1
    There’s an additional argument for supporting IP filtering in the app itself: It lets users set up multiple layers of filtering to avoid a single point of failure. Threat models that require this are rare, but they do exist, and some sysadmins are willing to take the maintainability hit of needing to keep things in-sync to have an extra layer of insurance even if they don’t need it to satisfy their threat model. – Austin Hemmelgarn 2 days ago

Your Answer

Anne Batch is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.