Restrict access to a specific controller by IP address in ASP.NET MVC Beta

Question

I have an ASP.NET MVC project containing an AdminController class - giving me URls like http://myserver/admin/AddCustomer, http://myserver/Admin/ListCustomers, etc.

I want to configure the server/app so that URIs containing /Admin are only accessible from the 192.168.0.0/24 network (i.e. our LAN)

I'd like to restrict this controller to only be accessible from certain IP addresses.

Under WebForms, /admin/ was a physical folder that I could restrict in IIS... but with MVC, of course, there's no physical folder. Is this achievable using web.config or attributes, or do I need to intercept the HTTP request to achieve this?

Answer 1

You should have access to the UserHostAddress in the Request object in your controller to do the restriction on. I'd suggest that you may want to extend the AuthorizeAttribute and add your IP address restrictions on it so that you can simply decorate any methods or controllers that need this protection.