Filter requests based on IP address

Configure SuperTokens to allow or deny requests based on specific IP addresses for enhanced security.

Overview

You can configure SuperTokens Core to allow or deny requests from specific directly connected peer addresses.

Before you start

Allow requests

 docker run \
    --network app-network \
    -e IP_ALLOW_REGEX="^10\.0\.0\.12$" \
    -d "$SUPERTOKENS_IMAGE"

# You need to add the following to the config.yaml file.
# The file path can be found by running the "supertokens --help" command

ip_allow_regex: '^10\.0\.0\.12$'

The example allows only a backend whose directly connected private address is exactly 10.0.0.12. Replace it with a stable private address assigned to your backend or trusted proxy. The anchors prevent partial matches and each dot is escaped so that it means a literal dot.

To allow exact backend addresses, escape IPv4 dots and anchor the alternatives. For example: ^(100\.12\.12\.3|192\.167\.4\.3|50\.32\.5\.1)$.

If this value is not set, then the core allows requests from any IP address.

Deny requests

This is the opposite of the above configuration. If you only set this, the core allows requests from any IP other than the one that matches the regular expression corresponding to this setting.

 docker run \
    --network app-network \
    -e IP_DENY_REGEX="^10\.0\.0\.99$" \
    -d "$SUPERTOKENS_IMAGE"

# You need to add the following to the config.yaml file.
# The file path can be found by running the "supertokens --help" command

ip_deny_regex: '^10\.0\.0\.99$'

The above setting makes Core accept requests from any directly connected peer other than exactly 10.0.0.99. For that address, it returns a 403.