How php know if the user comes from specific Intranet

sunnyside

I need to develop a script which can tell if user comes from a specific intranet (e.g. company ABC).

I original used IP address/range to make this done, but found out it's not a good solution. Because if a company has more than 200 location national wide, they can't just fill in hundreds of different ip address/ranges.

The scenario is: company ABC has 150 locations national wide, their employee click a button/link to a website D. The website D should know it's from company ABC internal user.

Can you tell me what would be the best solution for this?

Thanks a lot!

wilku

if all the company IPs can be reversed by DNS to a common domain name (e.g anything.companyname.com) you can check for this domain name. Reverse DNS lookup has to be anabled in the web server to populate $_SERVER['REMOTE_HOST'], which is said to decrease server speed.

sunnyside

wilku wrote:
if all the company IPs can be reversed by DNS to a common domain name (e.g anything.companyname.com) you can check for this domain name. Reverse DNS lookup has to be anabled in the web server to populate $_SERVER['REMOTE_HOST'], which is said to decrease server speed.

Yes, I've been thought about it, but I really doubt. Their working ip address could be from their local ISP; and the domain could be in some specific server from data center.

rulian

I wouldnt think you'd be able to do this with PHP alone
You can set up your server to be accecible via VPN's only,
if the website needs to be accecible via the web and vpn, and is located remotely then I dont think the PHP can distinguish between a regular user and an internal user.

Having server parameters via VPN's or something more complex would be your best bet but it requires the network to be properly maintained to make sure all the security tokens match up.

Or.... if all else fails, you can do what I always do in non - security issues, ask the user

Horizon88

another way to find hostname is gethostbyaddr($_SERVER['REMOTE_ADDR']) but I can't imagine it would be too difficult to spoof those. I think Rulian's suggestion for a VPN is going to be your best bet.

sunnyside

thank you guys. will give it a try!🙂