title: Only allow mvc web api to be called from Ip address
body: <p>Hi I'd like to restrict access to my MVC Web API app by IP address. I thought it might make a good security "layer". But I have some questions.</p>
  
  <p>This api isn't protecting sensitive data, I'm thinking it would be useful way to help deter someone trying to hack the api. I'm new to this and would like pragmatic best practices.</p>
  
  <p>Both API and client are using SSL certs so the IPs are static. But the users on the client will be unauthenticated public users of a website, my team have have no meaningful control over this.</p>
  
  <p>What is the most reliable way to detecting IP in MVC?</p>
  
  <p>How easy is it to spoof?</p>
  
  <p>I'd prefer to do the code in an attribute rather than the web config so as team we can lock the controllers down with differing mechanisms on a more granualar level if the needs of the API change.</p>
  
  <p>Or is this not a particularly useful approach? I'm open to alternatives.</p>