PHP：获取客户端IP或MAC地址以“证明”客户端来自自己的Intranet？

Question

Note: This is a logic/security question, not really a 'how to' for PHP.

First the background...

I want to restrict access to a company INTRAnet website to only people who are using a company computer (Windows or Linux) and who are connected to our company network 'in office' or remote via VPN.

At the moment users log in with their company userid and password, which are authenticated via LDAP, for every session. I want to make life a little easier for them and allow them to use a 'remember me' option at login and then store some information in a cookie.

The information I thought of putting in the cookie is their username and either the client IP address or client MAC address and setting an expiry of 30 days for example. On a subsequent login then existence of this cookie indicates a valid user and valid client are being used, so no need to login again (pass-through).

Now the question(s)...

Is it the case, that a system call from PHP will only return an IP or MAC address if the client is authorized on and connected to our corporate network? If this is true then by reverse logic, getting a null return value from one or both of these addresses means the client computer is not authorized to connect to our corporate network - is that correct? Is there a better way (more secure way without having users forced to log in each session) of solving this?

Thanks in advance.

Answer 1

A MAC is only available on the same subnet; if your intranet is a little more expansive it will probably have routing internally, especially if VPNs are involved as well. So there's no reliable way to get the MAC address of the client, no.

The IP is bound to change very likely as clients go online and offline, so an IP is useless as well.

Really, if your concern is that the application should only be accessed via the intranet, the best way to ensure that is to configure the intranet/server to only be physically accessibly via the intranet. If the network won't route external requests to the server, then there's no way anyone from outside could access the server/application. Worrying about this in application code is the wrong place.