Access Restriction by IP

Stolen or shared passwords are a risk when users can log in from anywhere. This module adds an Allowed IP list to each user, and the login screen checks the address of the visitor against it. Administrators manage the lists, and the check works for every user that has at least one address. Users with an empty list log in normally. The benefit is an extra layer of protection against unauthorised access.

1. 1

   Open the user form

   The administrator opens Settings, Users and selects a user. An Allowed IP list appears on the form. Only administrators should edit it.

   • Screen: Settings > Users
   • Editable list: Allowed IP
2. 2

   Add allowed IP addresses

   In the list the administrator adds one line per permitted address, typing it in the Allowed IP column. Several lines can be added for users who work from several places. Saving stores them on the user.

   • Column: Allowed IP
   • One line per address
3. 3

   Login check

   The module overrides the /web/login page. When a user submits the form, the system looks up the user by login and compares the visitor address with the allowed list. If the list is not empty and the address is not in it, the login is refused with the message Not allowed to login from this IP.

   • Route: /web/login
   • Message: Not allowed to login from this IP
   • Address read from the request
4. 4

   Normal login for allowed users

   If the address is allowed, or the user has no list, the usual authentication runs with login and password. A wrong password still gives the Wrong login/password message. Successful users are redirected as normal.

   • Empty list means no restriction
   • Wrong password message unchanged

Back to version applications