How do I use IIS' IP Address and Domain Restrictions to deny access to my MVC controller method?

Question

I have one method in my controller that I wish to limit access to using IIS' IP Address and Domain Restrictions feature.

This IIS feature works well to limit access to files and folders. Can it be used to limit access to my controller method? This method does not have an associated view, as it is simply receiving a postback.

My post url to my method is like: http://myserver.com/myControllerMethod

How can I restrict access by IP to this?

Answer 1

You will not be able to use IIS' IP Address and Domain Restrictions feature at action (method) level. It is site level feature. Alternatively you can write your own authorization filter which can read list of restricted domains and IPs from configuration file and check incoming request against that list.