Unfortunately, I don't think this is a very secure approach. There are a number of reasons why:
- NAT in your local network
- NAT at your ISP (Carrier-grade NAT)
- Proxies anywhere between your browser and your web server
- Load balancers in front of your web server
Any one of these may result in multiple devices accessing your page to share the same IP address.
In case you're not familiar: Network Address Translation (NAT) allows multiple systems on a network to access the Internet from the same public IP address. This is necessary because there are far more systems accessing the Internet than there are public IPv4 addresses available.
Most households run a router which performs NAT for them, meaning any system connecting to the Internet (e.g. your desktop, laptop, tablet, phone, television) will come from the same IP address. That also means that any one of these systems can access your web page, and will be authenticated.
It gets worse than that. Your ISP could be running Carrier-grade NAT (CGN) - which means that a whole bunch of households will share the IP address as you. That means that any one of them could access your web page, and will be authenticated.
Then there are proxies. If your browser sends traffic through a proxy (such as one hosted by your ISP), or your website sits in front of a content delivery network (CDN), then you will most likely get the IP address of the proxy or CDN edge node, rather than the IP address of your computer.
Finally, if your web host has a load balancer in front of your web server, then you may end up with the IP address of the load balancer.
For all of these reasons, I would definitely not recommend a login mechanism which relies solely on the IP address of the user accessing your web page.
If you don't want to write the code for authentication yourself, then I would recommend checking out some third party libraries for doing this - though be sure that you review the code before implementing it into your web page.
In regards to IP Spoofing
Others have mentioned the risk of IP spoofing, which sounds easy in theory, but (even in a simplified form) it would require two different steps:
- Change the IP address in the header of the IP datagram
- Intercept the response from the server to read the results
The first bit is not difficult by itself. The difficulty is that the server will send the response to the spoofed IP, rather than the attackers IP. In order to read the response, the attacker would therefore need intercept the response to the user. This would generally be quite difficult.