IP check using ASP.NET Forms Authentication

Question

I'm implementing simple authentication on an asp.net web site. Using the basic forms authentication is almost perfect: I set the auth mode to Forms and have a short credentials section in web.config, and use a simple Login aspx page that uses FormsAuthentication.Authenticate() and FormsAuthentication.RedirectFromLoginPage().

However, I would like to add the additional check for certain client IP addresses. If a request comes from a certain IP address, I want to automatically authorize the request and not redirect that request to the Login page. Is there an easy way to extend or override the built-in forms AuthenticateRequest? My other option is to create my own HttpModule to do this, but it seems if I do I lose the nice functionality of the FormsAuthentication methods and their interactions with the credentials section. Any suggestions?

Answer 1

First, are you sure you want to do this? IP spoofing would be an ideal way to then attack your site if anyone could guess the range of IP addresses that you were not verifying! Even if they just knew the range of addresses, this makes a brute force attack trivial.

Second, you can just check the IP address in the login page and redirect from there...no need for an HttpModule. But, again, I would NOT do this if I were you.

UPDATE: R G - a couple of things. My thinking was that you would do an Authenticate() call before redirecting. This would avoid having the redirect loop back. But it looks like you don't even need that because...

Second, from your comment below (in Ben's post), you'll be using this code in a Web Service. If that is the case, couldn't you put the web service in the Web.Config page as a permitted access page? Just add this:

<location path="YourWebService.asmx">
  <system.web>
    <authorization>
      <allow users="*" />
    </authorization>
  </system.web>
</location>

This is what we do although we do require that the users of our web service send along a "magic phrase" before we'll process the web service request (it is also SSL encrypted).

Answer 2

I agree with Mark.

If you'd like to make it extremely easy for clients to connect to your site after first verifying their credentials (properly), you can give them an essentially everlasting persistent cookie by modifying web.config:

<system.web>
    ...
    <authentication mode="Forms">
      <forms timeout="50000000" />
    </authentication>
    ...
</system.web>

Also call RedirectFromLoginPage() with createPersistentCookie set to true.

EDITED Caveat: if you do this (or indeed give persistent cookies of any duration), also give users the option to decline a persistent cookie with a checkbox of some kind. (Best if it works in reverse: they have to check it to get a persistent cookie, titled with "click this to remember me on this computer" or similar.)

Answer 3

The REMOTE_ADDR server variable will give the requesters IP address and you can check it againt a list of allowed addresses.

http://msdn.microsoft.com/en-us/library/ms524602.aspx

Also, you can configure IIS to only allow certain IP address in the IIS management console and forgo the code, if that's an option for you.

Answer 4

hi any one know the solution how to make the login automaticaly by recognise the IP Address

I have to implement the same concept anyone help me..