Can I fool HttpRequest.Current.Request.IsLocal?

Question

I'm running a web application that displays some debugging behavior if it's being run locally - quotes around resource strings, etc - and I'd like to demo the application on my laptop at a conference where I won't have internet access, so it has to be local.

The application uses HttpContext.Current.Request.IsLocal to determine if it's running locally - is there any way to fool it? I'd like to trick it into returning "False" even though I am indeed running locally.

I do have access to the source code (and realize I could just demo a build where the "IsLocal" check is commented out), but would rather not make a special build for this demo. If need be, I'll do that, but I'd rather use the existing codebase untouched.

Answer 1

Request.IsLocal property implements the following code :

public bool IsLocal { 
            get {
                String remoteAddress = UserHostAddress; 

                // if unknown, assume not local
                if (String.IsNullOrEmpty(remoteAddress))
                    return false; 

                // check if localhost 
                if (remoteAddress == "127.0.0.1" || remoteAddress == "::1") 
                    return true;
 
                // compare with local address
                if (remoteAddress == LocalAddress)
                    return true;
 
                return false;
            } 

Source : Decompiled source code (Microsoft : referencesource.microsoft.com )

Hope this helps !

Answer 2

That would require spoofing a non-local IP address in requests to your local instance of IIS. I think you'd probably spend less time just making a demo build than trying to make that work.