# Perspective security

**URL:** <https://forum.inductiveautomation.com/t/perspective-security/53699>\
**Category:** Ignition\
**Created:** [December 2, 2021, 8:19pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699 "2021-12-02T20:19:49Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkhoshroo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pkhoshroo/32/26801_2.png) [@pkhoshroo](https://forum.inductiveautomation.com/u/pkhoshroo)\
**Post date:** [December 2, 2021, 8:19pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699/1 "2021-12-02T20:19:49Z")

</div>

Hello all,

I am trying to add security to my project so that the user with specific IP addresses can log in. I can do this for my vision client with this script:

```auto
ipaddress = system.tag.read("[System]Client/Network/IPAddress").value
if ipaddress == "100.168.2.56":
	system.security.logout()
else:
	system.security.lockScreen()

```

But I am not able to do the same thing in session event script using this script:

```auto
ipaddress = system.net.getIpAddress()
if ipaddress == "100.168.2.56":
	system.security.logout()
else:
	system.security.lockScreen()

```

Should I use a security zone for this? That one will only allow for some specific policy not log in/log out from a perspective project.

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [December 2, 2021, 8:27pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699/2 "2021-12-02T20:27:48Z")

</div>

In perspective this script will be run on the gateway, and so will only return the Ip address of the Gateway Server.

Due to browser security, I would guess it would be impossible to get the IP address of the users PC.

As an aside, why would it matter what IP a user opened a client from? This is exactly the thing that Users and User Roles are made for. If an unauthorized user logs in with invalid credentials then they wouldn’t have access.

---

<div class="post-metadata">

**Author:** ![pkhoshroo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pkhoshroo/32/26801_2.png) [@pkhoshroo](https://forum.inductiveautomation.com/u/pkhoshroo)\
**Post date:** [December 2, 2021, 8:29pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699/3 "2021-12-02T20:29:41Z")

</div>

Thank you! The thing is sometimes we want to be able to detect the IP address of the user and location they are in and then give them access. For example, a remote user with the IP of 1.2.3.4 cannot log in to the perspective project.

I also tried this script on gateway events too but it did not work.

---

<div class="post-metadata">

**Author:** ![JoeF](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@JoeF](https://forum.inductiveautomation.com/u/JoeF)\
**Post date:** [December 2, 2021, 8:31pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699/4 "2021-12-02T20:31:13Z")

</div>

Agree that you should be using security roles if possible.

But if you absolutely must use IP address to facilitate this, try using session properties like session.props.host or session.props.address in conjunction with [system.perspective.logout()](https://docs.inductiveautomation.com/display/DOC80/system.perspective.logout) or [system.perspective.closeSession()](https://docs.inductiveautomation.com/display/DOC81/system.perspective.closeSession)

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [December 2, 2021, 8:52pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699/5 "2021-12-02T20:52:27Z")

</div>

> [@pkhoshroo](#):
>
> I also tried this script on gateway events too but it did not work.

From the manual:

> Returns the IP address of the computer that the script was ran on. **When run in the Gateway scope, returns the Gateway IP address**. When run in the Client scope, returns the Client IP address.

`system.net.getIpAddress()` will return the **Gateway's** IP address.

When you say it didn't work, does that mean you got an error, or it didn't do what you expected?

I believe that Security Zones are the answer to this particular issue. Then rather than granting access based on an IP address, you would grant it based on a security zone.

---

<div class="post-metadata">

**Author:** ![pkhoshroo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pkhoshroo/32/26801_2.png) [@pkhoshroo](https://forum.inductiveautomation.com/u/pkhoshroo)\
**Post date:** [December 2, 2021, 8:54pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699/6 "2021-12-02T20:54:09Z")

</div>

It did not work the way I expected. So it did not logout the user nor witched the use based on IP

---

<div class="post-metadata">

**Author:** ![swolnisty](https://avatars.discourse-cdn.com/v4/letter/s/7bcc69/32.png) [@swolnisty](https://forum.inductiveautomation.com/u/swolnisty)\
**Post date:** [December 2, 2021, 11:53pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699/7 "2021-12-02T23:53:25Z")

</div>

Something that you hinted at with your suggestion but did not outright say is that those system.security functions in @pkhoshroo’s initially posted scripts are specifically Vision client-scoped functions, and as such will not run in a Perspective session.

As you said, I think a change script on session.props.address (assuming OP is using a recent enough version of Ignition to have access to this property) that evaluates whether the IP address is allowed or not is likely the best bet.

---

<div class="post-metadata">

**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\
**Post date:** [December 2, 2021, 11:55pm UTC](https://forum.inductiveautomation.com/t/perspective-security/53699/8 "2021-12-02T23:55:46Z")

</div>

You should create a new security ZONE which “black-lists” the IP address (or white-lists the range of IPs which do not include the bad IP address), and then your project should require that security zone.

 ![Screen Shot 2021-12-02 at 3.54.50 PM](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/3/23ceaf8bb3cd54e24d6ac9e56fd8dac6cee5ca20.png)