How to restrict endpoints for IP addresses in .Net Core

By adminOn December 5, 2023December 17, 2023

We can achieve this by creating a custom middleware in ASP.NET Core. This middleware will check the IP address of the incoming request and compare it with the allowed IP addresses. If the IP address is not allowed, it will return a 403 Forbidden status.

Here’s an example of how you can implement this:

public class IPFilterMiddleware
{
    private readonly RequestDelegate _next;
    private readonly string _allowedIP;

    public IPFilterMiddleware(RequestDelegate next, string allowedIP)
    {
        _next = next;
        _allowedIP = allowedIP;
    }

    public async Task Invoke(HttpContext context)
    {
        var remoteIpAddress = context.Connection.RemoteIpAddress;

        if (!_allowedIP.Equals(remoteIpAddress.ToString()))
        {
            context.Response.StatusCode = (int)HttpStatusCode.Forbidden;
            return;
        }

        await _next.Invoke(context);
    }
}

We can register this middleware in the Configure method in your Startup class:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseMiddleware<IPFilterMiddleware>("127.0.0.1"); // Replace with your allowed IP

    // Other middleware...
}

This will apply the IP filter to all endpoints. If you want to apply it to specific endpoints, you can create an attribute and use it to decorate the controllers or actions you want to protect:

public class IPFilterAttribute : Attribute, IAsyncResourceFilter
{
    private readonly string _allowedIP;

    public IPFilterAttribute(string allowedIP)
    {
        _allowedIP = allowedIP;
    }

    public async Task OnResourceExecutionAsync(ResourceExecutingContext context, ResourceExecutionDelegate next)
    {
        var remoteIpAddress = context.HttpContext.Connection.RemoteIpAddress;

        if (!_allowedIP.Equals(remoteIpAddress.ToString()))
        {
            context.HttpContext.Response.StatusCode = (int)HttpStatusCode.Forbidden;
            return;
        }

        await next();
    }
}

You can use this attribute to protect your controllers or actions:

[IPFilter("127.0.0.1")] // Replace with your allowed IP
public class MyController : Controller
{
    // Actions...
}

Related