---
title: Filter requests based on IP address
description: Configure SuperTokens to allow or deny requests based on specific IP addresses for enhanced security.
sidebar:
  order: 2
---

## Overview

You can configure SuperTokens Core to allow or deny requests from specific directly connected peer addresses.

:::warning
Core evaluates the address of the peer connected to it. It does not establish trust in `X-Forwarded-For`. Behind a reverse
proxy, Core normally sees the proxy address, not the original client address. Filter client IPs at a trusted proxy or
firewall; use Core's filter only for the backend or proxy addresses that connect directly to Core. Keep Core private and
use API-key authentication as defense in depth.
:::

## Before you start

:::warning
This page is only relevant if you are self-hosting SuperTokens.

The option is not available if you are using the managed version of SuperTokens due to security reasons.
In this case, you have to configure the filtering mechanism in your backend server.
:::


---

## Allow requests 

<CodeGroup group="docker">
<Tab title="With Docker" value="with-docker">
```bash
 docker run \
    --network app-network \
    -e IP_ALLOW_REGEX="^10\.0\.0\.12$" \
    -d "$SUPERTOKENS_IMAGE"
```
</Tab>
<Tab title="Without Docker" value="without-docker">
```yaml
# You need to add the following to the config.yaml file.
# The file path can be found by running the "supertokens --help" command

ip_allow_regex: '^10\.0\.0\.12$'
```
</Tab>
</CodeGroup>

The example allows only a backend whose directly connected private address is exactly `10.0.0.12`. Replace it with a
stable private address assigned to your backend or trusted proxy. The anchors prevent partial matches and each dot is
escaped so that it means a literal dot.

To allow exact backend addresses, escape IPv4 dots and anchor the alternatives. For example:
`^(100\.12\.12\.3|192\.167\.4\.3|50\.32\.5\.1)$`.

If this value is not set, then the core allows requests from any IP address.

---

## Deny requests 

This is the opposite of the above configuration. If you only set this, the core allows requests from any IP other than the one that matches the regular expression corresponding to this setting.

<CodeGroup group="docker">
<Tab title="With Docker" value="with-docker">
```bash
 docker run \
    --network app-network \
    -e IP_DENY_REGEX="^10\.0\.0\.99$" \
    -d "$SUPERTOKENS_IMAGE"
```
</Tab>
<Tab title="Without Docker" value="without-docker">
```yaml
# You need to add the following to the config.yaml file.
# The file path can be found by running the "supertokens --help" command

ip_deny_regex: '^10\.0\.0\.99$'
```
</Tab>
</CodeGroup>

The above setting makes Core accept requests from any directly connected peer other than exactly `10.0.0.99`. For that address, it returns a `403`.

:::info[What if you set both the configurations?]

In this case, Core allows a request only if it matches `ip_allow_regex` and does not match `ip_deny_regex`.

:::