IP-range ‘filter’ and caching

[thijs]

Hey all,

For a project I’m working on I need a specific section of the website to be visible only for visitors from one country, visitors from all other countries should not be able to view this menu item and page. I think I can bend the Page Render IP-restriction module to set a $page->variable indicating if the visitor is from that country or not. But I’ve got some questions

Caching the IP-restriction action

Would it be advisable to save this variable in the user’s session so the site doesnt have to go through all ip-ranges to check up on this for every page load?

Caching the website pages

This is the tricky one (I think). Can I still cache the website pages when not all visitors should be served the same page content? I think I’d need two versions of each cached page, but wouldnt really know if that is possible? 

Thanks for reading and your insights are very welcome!

[teppo]

I'm sure you already know this, but still:

Location can't be reliably identified based on IP alone. Even if you use a very large list of IP's connected to location data that some sites distribute, you'd still have to take into account various proxy services, possible human error etc.

Essentially this kind of feature is OK for offering extra value for some users, but it's definitely not a good idea to rely on it alone to provide any security-related features. Just saying. But to get to your questions..

Caching the IP-restriction action

Would it be advisable to save this variable in the user’s session so the site doesnt have to go through all ip-ranges to check up on this for every page load?

If you're going to have a lot of IP ranges (and you'll probably have if your list is even half comprehensive) this might be a very good idea. As a matter of fact, since you mentioned it here, I've started thinking that perhaps I should include something similar to the original module itself.. can't give an ETA for that yet though, and it might not even be of benefit in your case

Caching the website pages

This is the tricky one (I think). Can I still cache the website pages when not all visitors should be served the same page content? I think I’d need two versions of each cached page, but wouldnt really know if that is possible? 

This is a tricky question. First of all, I'd suggest looking into Markup Cache -- it'll allow you to cache parts of your page, even if whole pages can't be easily cached. That's probably the easiest method here.

Other option would be caching two versions, like you've pointed above, but as far as I know that's not really an option available out-of-the-box. Template Cache allows you to cache URL segments, so you might be able to work around this problem using that for an example. Could get very complicated very fast though.

With commercial Pro Cache module you can bypass the cache when certain cookie is set.. though it might be difficult to set that cookie if pages keep getting served from cache. That could be an option if you're relying on some pages not being cached, ie. users always entering via root page which won't be cached at all. Doesn't sound like a good idea, but I don't really know your whole setup, requirements and plan here either, just throwing in ideas

Edit: as a matter of fact, you could probably also use modified Page Render IP Restriction to set $session->PageRenderNoCache and that way skip Template Cache for either local or non-local users, even without relying on Pro Cache module. Page Render IP Restriction runs before Template Cache can work it's magic, so this should be possible. Obvious downside here would be that part of your audience won't benefit from caching at all.

[thijs]

Thanks so much for your extensive answer, and for making this module. And indeed, relying on ip for getting someones location is definitely not airtight, but all we’ve got. I’m not using it for a security feature, just to show/hide content that is (ir)relevant to that specific group.

For now I’ve stripped down your module quite a bit. It now first checks if if the session variable is set, if not it will iterate through the list of ip’s / ip-ranges. It sets the variable to true if it has found a match, or sets it to false if it has not found a match.

Regarding the caching, thanks for your insights. I think Markup cache would be the best way to go, too bad I cant use the default caching, which is something that has been working well for me so far. If Pro cache could help me out that would be awesome, but I cannot rely on people entering the website on a single url. 

Now that I read about the PageRenderNoCache (good one!), would it be possible to serve a cached version of the page if the session variable from above has been set, and if it has not been, not to serve the cache page? That would be real great. I’m not sure what code is being executed and what not when a cached page is being served, is it just the template output that is being cached? In other words; do modules run/execute also when serving cached pages?

– And many thanks again