Home/ Questions/Q 1055813
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T17:37:15+00:00

I have some extra features on a site that employees can use but customers

  • 0

I have some extra features on a site that employees can use but customers are not allowed to see.

The employees are all going to be on a series of domains.

What I do is get the user ip like so:

$user_ip = gethostbyname($_SERVER['REMOTE_ADDR']);

Then I get an array of all the ips for the domains the users will be on using gethostbyname

Then I check if the user is on one of the domains like so:

in_array($user_ip,$allowedIPS)

So if the user is on one of the domains they see additional features for internal use. Otherwise they just see what is meant for the general public.

My questions is, is this secure? Or could someone potentially spoof their IP to appear like they are on our domain and gain access to these features?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It is impossible to spoof a TCP connection over the open internet due to the Three Way Handshake. However, it maybe possible to access this feature using CSRF.

    PHP pulls $_SERVER['REMOTE_ADDR'] directly from Apache’s TCP socket, there for it cannot be influenced by an attacker. And yes, i have looked at this code.

    • 0