Have Geek Brain

From an ASP.Net web form perspective, can Request.UserHostAddress be trusted?

I have a web form that should act differently if the request for that form comes from an internal network address or from a public IP address. I am trying in my web form to determine if the request is the internal IP of the network. Can I reliably do this, or can clients spoof the original IP address? Can I trust the information in Request.UserHostAddress?

0


a source to share


2 answers


No, you cannot, unfortunately. It's pretty trivial to build an HTTP request with bogus headers.



+1


a source


IP Spoofing is mostly possible: Wikipedia , but has limited use (as far as I understand, it is very difficult to actually pull any data this way)



Your best bet would be to route / restrict traffic at the firewall or proxy level (create a rule to only allow local traffic to go to your site) in order to create maximum security.

+1


a source






More articles:


All Articles