Does Heroku support an inbound firewall? I'd like to restrict access to my app by IP. I have two sites that need access to it and both have static IP addresses.

There isn't a configurable firewall (like AWS security groups). You could write some simple HTTP middleware at an application level however that checks <code>X-Forwarded-For</code> (https://devcenter.heroku.com/articles/http-routing#heroku-headers) against a whitelist. IP restrictions aren't a 1:1 replacement for a proper authentication system though.

Restrict access to Heroku app by IP?

1 Answers

There isn't a configurable firewall (like AWS security groups).

You could write some simple HTTP middleware at an application level however that checks X-Forwarded-For (https://devcenter.heroku.com/articles/http-routing#heroku-headers) against a whitelist.

IP restrictions aren't a 1:1 replacement for a proper authentication system though.