IP whitelisting
Authorising a proxy by the address you connect from, instead of sending a username and password.
IP whitelisting authorises use of a proxy based on the address your requests originate from. You register your server’s public address with the provider, and requests from it are accepted without credentials.
#Why it is used
- No credentials in configuration files, environment variables or logs.
- Slightly lower overhead, since there is no authentication exchange.
- Convenient for fixed infrastructure with a stable address.
#Where it breaks
- Dynamic addresses. A home connection or an autoscaling instance changes address and access stops without warning.
- Shared addresses. Anyone else behind the same NAT can use your allocation.
- Slow propagation. Whitelist changes are not always instant, which is painful during an incident.
#Choosing between the two
For fixed servers, whitelisting is clean. For anything that moves, scales or runs on a laptop, credential authentication is more robust. Some providers allow both at once, which is usually the pragmatic answer.