THE PERILS OF IP ADDRESS AND DOMAIN NAME RESTRICTIONS

This technique should be used with caution—there are a lot of potential pitfalls. First, this is still URL-based authorization, and it still doesn't fit perfectly with the MVC Framework routing system.

Second, restricting access in this way doesn't take account of how users may interact with our application. To take a simple personal example, Adam connected to the Internet at home first thing this morning. Later he connected from a coffee shop, a friend's house, another friend's office, and then again later at home. On some of those occasions he used a commercial VPN service, but other times he connected directly. If you think that Adam is unusually mobile, then you haven't noticed the huge shifts in the way that people connect to and consume Internet applications. Restricting access based on where a person is connecting from is easy to set up and very difficult to get right.