Implementing and Testing IP SafeLists in ASP.NET Core

How to implement and test IP restrictions in an ASP.NET Core Web API project

We sometimes want to limit our application to only certain IP addresses or IP network ranges. For example, during beta testing, we prefer to only allow admins and preselected testers to access the new website. Besides blocking the whole application, we sometimes want to expose most APIs in an application but restrict a few API endpoints to a confined network so that sensitive data won’t be scrapped.

IP restrictions can be done at several levels to achieve security goals. As developers, we can properly guard our applications and API endpoints in the code so that they are available to trusted network addresses. The official tutorial, Client IP safelist for ASP.NET Core, has documented different ways to implement an IP address safelist (a.k.a., an allow list) in an ASP.NET Core app. Unfortunately, the official tutorial doesn’t cover the configuration of CIDR blocks.

In this article, we will go over some implementation details for allowing a list of IP addresses and CIDR blocks to access our API endpoints. We will create a middleware and an action filter. Each of them can be used in the request pipeline to bounce back requests if the remote IP address is not in the configured network range. We will write integration tests to verify the functionalities of the middleware or the action filter. In the end, I will show you how to use ngrok (https://ngrok.com/) to test the application from another computer other than our dev machine.

The full solution can be found in my GitHub repository. Now let’s dive in.

Implementation

We are not going to steal the thunder from the official tutorial in Microsoft Docs. We only want to improve the code a little bit by handling CIDR blocks because CIDR blocks are commonly being used to configure IP safelists.

In this solution, we will use a NuGet package IPNetwork2 to parse IP addresses and CIDR blocks in a configuration file. This NuGet package enables developers to easily take care of the complex network, IP, IPv4, IPv6, netmask, CIDR, subnet, subnetting, supernet, and supernetting calculations. It’s worth noting that the…