Search code examples
heroku

Restrict access to Heroku app by IP?

Does Heroku support an inbound firewall? I'd like to restrict access to my app by IP. I have two sites that need access to it and both have static IP addresses.

Solution

  • There isn't a configurable firewall (like AWS security groups).

    You could write some simple HTTP middleware at an application level however that checks X-Forwarded-For (https://devcenter.heroku.com/articles/http-routing#heroku-headers) against a whitelist.

    IP restrictions aren't a 1:1 replacement for a proper authentication system though.