How can I prevent requests from certain domain in web.config? - asp.net-mvc

Question

I want to restrict one domain for my application in web.config. How can I do it? I just found solution for IIS settings, like
<add ipAddress="some_ip_address" />
but I want to restrict a domain, not IP address

Answer 1

There is no direct way to not allow specific domain.You can restrict certain IPs only.
You can always use nsloopkup to map domain to its IP addresses.
<security>
<ipSecurity allowUnlisted="true">
<clear/> <!-- removes all upstream restrictions -->
<add ipAddress="83.116.19.53"/>
</ipSecurity>
</security>

Answer 2

There is no direct setting in the web.config to do this. However you can create a custom collection in the web.config to list your domains and the write a custom requesthandler or a custom actionfilter that would block the specific domain. However this can very easily be spoofed or bypassed. Here is an example:
Your configsection class:
public class DisallowedDomainsSection : ConfigurationSection
{
// Create a "remoteOnly" attribute.
[ConfigurationProperty("remoteOnly", DefaultValue = "false", IsRequired = false)]
public Boolean RemoteOnly
{
get
{
return (Boolean)this["remoteOnly"];
}
set
{
this["remoteOnly"] = value;
}
}
// Create a "domain" element.
[ConfigurationProperty("domainName")]
public DomainElement Domain
{
get
{
return (DomainElement)this["domainName"]; }
set
{ this["domainName"] = value; }
}
}
Then you declare your config section in the configSections node:
<configSections>
<sectionGroup name="disAllowDomainsGroup">
<section
name="disallowDomains"
type="your.class.definition"
allowLocation="true"
allowDefinition="Everywhere"
/>
</sectionGroup>
</configSections>
Then you declare the action section:
<configuration>
<!-- Configuration section settings area. -->
<disallowDomainsGroup>
<disallowDomain remoteOnly="true">
<domainName="www.google.com" />
</dissallowDomain>
</disallowDomainsGroup>
</configuration>
Finally you create a ActionFilterAttribute to get the list of disallowed domains and redirect/restrict the user if they are originating from the domain.
You can access the newly created webconfig section like this:
DomainsDisallowedSection config =
(DomainsDisallowedSection)System.Configuration.ConfigurationManager.GetSection(
"disallowDomainsGroup/disallowDomains");
and then iterate through your disallowed domains and use
HttpContext.Current.Request.Url.Host
to match the disallowed domain with the request domain. But as previously stated this can be bypassed quite easily by someone who knows how.

Answer 3

In IIS Manager:
Select the desired site.
In the Home pane, open IP Address and Domain Restrictions.
In the Actions pane, launch Edit Feature Settings...
Check the box for Enable domain name restrictions
Click [OK] to exit.
You can now add domain names the same way you add IP addresses.
Note: This cannot be done through web.config. The settings are stored in ApplicationHost.config. You will have to get access to IIS Manager to enable IP and Domain Security though. There is no way around this.
<ipSecurity enableReverseDns="true">
<add ipAddress="192.168.0.1" allowed="false" />
<add domainName="google.com" allowed="false" />
</ipSecurity>