function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
Derek BrostDerek Brost 

Can I limit access to Visualforce pages via IP?

Hi Everyone, 

I am looking at building a dashboard to display to our teams internally. I want to set up multiple Visualforce pages that have different datasets. Once these pages are created I want to use a URL slideshow to show each page. The issue I have found with this is that I would need to login to the Visialforce page to be able to display it. 

I know I could make the page open to the outside world, but most of the data is data I wouldn't want someone to come acorss or access when they leave. 

I was wondeirng if there is a way to make the pages on accesable via IP or some other way. 

Thanks in advanced. 

Derek
Ajay K DubediAjay K Dubedi
Hi Derek,
Sometimes you might have a need to retrieve the IP address of a user in Salesforce.   You can do this with a simple function like this: 
public static String GetUserIPAddress() {
 string ReturnValue = '';  
   
 // True-Client-IP has the value when the request is coming via the caching integration.
        ReturnValue = ApexPages.currentPage().getHeaders().get('True-Client-IP');
 
          // X-Salesforce-SIP has the value when no caching integration or via secure URL.
        if (ReturnValue == '' || ReturnValue == null) {
         ReturnValue = ApexPages.currentPage().getHeaders().get('X-Salesforce-SIP');
        } // get IP address when no caching (sandbox, dev, secure urls)
 
         if (ReturnValue == '' || ReturnValue == null) {
         ReturnValue = ApexPages.currentPage().getHeaders().get('X-Forwarded-For');
        } // get IP address from standard header if proxy in use
 
 return ReturnValue;
  
} // GetUserIPAddress
I recommend that you put this in a utility class and then reference it as needed in code. A great use for this is to limit access to certain pages by IP address. This is accomplished by calling the method in the constructor of a visual force page controller (or controller extension) and then using the value that is returned to check against a list. Here is a very simple example that uses a hard coded dummy IP address :  
public MyControllerExtension (ApexPages.StandardController stdController) {
 
        // notice that the method was placed in the Util class
        string UserIP = Util.GetUserIPAddress();
         
        if (UserIP != '1.2.3.4') {
PageUnAuthEnabled = true;
ApexPages.addMessage(new ApexPages.message(ApexPages.severity.ERROR,'Unauthorized Access from: ' + UserIP));   
        } else {
              PageUnAuthEnabled = false;
              // insert code here for normal constructor
        } // check for IP address
   } // constructor
Thanks.