Implementing Access Control based on a hard coded IP address
-
Can be done as it as an internal IP
-
Can be done for internet facing servers as there are no chances of IP conflicts
-
Is a good security practice
-
Is a bad security practice
Hardcoded IP addresses are inflexible, difficult to maintain, and provide a false sense of security since IPs can be spoofed or change. Proper authentication and authorization should be based on user identity, not network location.
Hard-coded IP-based access control is fragile and easily bypassed: IP addresses can be spoofed, NATed, reassigned via DHCP, or shared behind proxies, so an attacker who can present or route through the trusted IP defeats the control entirely. It's considered a weak, brittle mechanism rather than a genuine authentication or authorization control, whether the server is internal or internet-facing.