0

The specific idea is to tie a user to a specific IP address. At login time set a cookie with the IP address of the user and then check it against the address from which it is being sent from at every authentication process. To be explicit - I do want the authentication to fail if I use my laptop to login via a WiFi in a coffee shop and then try to continue working with my internet connection at home.

On the face of it, it seems like wp_validate_auth_cookie is the place into which to add the additional check, but it doesn't provide any useful filter. I guess I can override that function but this will be my last resort, does anyone have a cleaner ideas on how to accomplish it?

1 Answer 1

0

I don't know that I would use cookies for this as the user could just modify their cookie to match their current IP. You could store the user's IP as user meta at signup and then compare that to their IP during subsequent logins via the wp_authenticate_user filter.

Sample code (untested):

add_action( 'user_register', 'wpse157630_add_user_ip', 10, 1 );
function wpse157630_add_user_ip( $user_id ) {
  update_user_meta( $user_id, 'wpse157630_ip_address', $_SERVER['REMOTE_ADDR'] );
}

add_filter( 'wp_authenticate_user', 'wpse157630_check_user_ip', 10, 2 );
function wpse157630_check_user_ip( $user, $password ) {
  $stored_ip = get_user_meta( $user->ID, 'wpse157630_ip_address', true );
  if ( $stored_ip == $_SERVER['REMOTE_ADDR'] ) {
    return $user;
  } else {
    return new WP_Error( 'invalid_ip_address', 'Invalid IP address' );
  }
}

If you wanted to get crazy, you could store the user meta as an array of IP addresses and add a spot in the user edit screen to allow the user to add multiple IP addresses to compare against.

2
  • tnx, but the idea is to limit a user to an ip for a session, and not forever. The bigger problem unless I miss something, is that wp_authenticate_user is called only at login but is not called when the cookies are validated, so you can still login with your "fixed" IP but then continue to work with you computer at another IP. Aug 13, 2014 at 15:08
  • ah, I misunderstood what you were after then. :) Aug 13, 2014 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.