I’m working on a personal project and I’d like to add a feature where you can deny/allow access based on IP.

I’m not sure that the way I’m thinking about it is good enough.

The user would be able to specify multiple deny and allow ranges as IP[/CIDR] and then I would:

  • Go through all the “deny” ranges and if any of them matches reject access.
  • Go through all the “allow” ranges and if any of them matches permit access.
  • If nothing matches the final decision is taken by a default fallback policy that can be set to allow or deny.

Would this be good enough or are there scenarios that can’t be expressed this way?

PS: fwiw I did have a look at how other projects achieve this. Some let you define ranges and combine them with boolean logic in any manner, pseudo-programatically; that’s a bit too complex for mine. Some let you draw up a list where order matters and the first matching range “wins”; I’m not sure if that’s more capable than my way, and having order matter would complicate things for my code.

Appreciate any help. If you can link me to something that talks about this, that’s good too.

  • Pomal@sh.itjust.worksEnglish
    2·
    3 days ago

    You are correct in identifying that trying to make fetch happen won’t work. There’s already a multitude of options for establishing network security native to any OS, or an open project that’s deviated in their own way.

    You could write a wrapper for everything, but unless that’s the intent of your app it may be scope creep.