Restrict access to Heroku app by IP?

Question

Does Heroku support an inbound firewall? I'd like to restrict access to my app by IP. I have two sites that need access to it and both have static IP addresses.

Answer 1

There isn't a configurable firewall (like AWS security groups).

You could write some simple HTTP middleware at an application level however that checks X-Forwarded-For (https://devcenter.heroku.com/articles/http-routing#heroku-headers) against a whitelist.

IP restrictions aren't a 1:1 replacement for a proper authentication system though.