How to deny access to my server end points ? (PHP)

I've developed some software installed e.g. on www.example.com. It's accessed via an HTML web page. Some HTML buttons can call PHP end points which are also on that domain. I use JWT to secure login.

www.example.com

But what I also want to do is only allow access to the end points from the office, so I'm trying to get the PHP to block any access from other domains. But of course since the software is hosted from www.example.com domain, it sends end point requests from that domain, which is what I think has so far thwarted my current attempts.

www.example.com

I tried

header('Access-Control-Allow-Origin: https://www.example.com');


but don't think it will work for the above reason. It certainly doesn't block the end point when I try to access it via the www.example.com domain web interface, despite which computer network I use.

www.example.com

Maybe instead I have to check the client IP within the PHP and deny access if it doesn't match. But what if there's dynamic IP's and the IP's could change given enough time. Is there a way round that?

Any help appreciated.

3 Answers
3

First, regarding what you have tried already:

header('Access-Control-Allow-Origin: https://www.example.com');

header('Access-Control-Allow-Origin: https://www.example.com');

This will fail for a number of reasons:

CORS

CORS

curl

postman

IP Filtering

In a case like this the best bet is to simply filter by ip address, which you mentioned. Generally offices have static IP addresses or change rarely, so it is actually quite feasible to do. Presuming the entire office is NATed behind one router/ip address then it is quite simple because you just need the one rule: dump all traffic except port 80 (443?) coming from the office IP. You probably shouldn't bother doing this with PHP, however, because for PHP to reject the request on the basis of the IP address first requires your server to process the request, launch PHP, and pass it along. A simple firewall rule is much easier on server resources. Dynamic office IP addresses are almost unheard of, so unless you know that that is the situation for you, I wouldn't worry about it.

https://www.example.com/projects/

/projects/

Your idea on the domains is rather wrong. You need to understand one essential thing about a web server.

There is no such thing like "an access from a domain". It is not a "software" which is sending requests to endpoints but a client (which is usually a browser). A client may read some information from your server first, but it's unnecessary.

Long story short, you cannot limit an access to your endpoints "from a domain".

The idea for the ip address is more fruitful, and more plausible than you think. Offices seldom change their IP, least they use a dynamical one. So you can limit access to the whole www.example.com server (not only endpoints) based on the IP address of your office.

Though there is another culprit, as IP address can be forged, and thus it is possible to create a request that will be allowed to send something to your endpoint (however without the ability to get the response).

But I would consider such a protection rather unnecessary given you are using JWT for the authentication (and, I assume, HTTPS for the secured connection).

Ok, this is how I solved the problem:

In your server's File Manager, in the folder you wish to restrict access, create a new .htaccess file and add the following lines:

.htaccess

Order Deny, Allow
Deny from all
Allow from 1.2.3.4


where 1.2.3.4 is the IP address you wish to allow.

1.2.3.4

You can grant additional access by comma separating IP addresses or if that doesn't work just use additional Allow from lines.

Allow from

I believe you can also add wildcard IP addresses too.

Thanks for contributing an answer to Information Security Stack Exchange!

But avoid …

To learn more, see our tips on writing great answers.

Some of your past answers have not been well-received, and you're in danger of being blocked from answering.

Please pay close attention to the following guidance:

But avoid …

To learn more, see our tips on writing great answers.

Required, but never shown

Required, but never shown

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.