2. PHPRunner General questions
  3. By pass two factor authenication for requests originating from internal / specific ip addresses
This topic is locked

By pass two factor authenication for requests originating from internal / specific ip addresses

 		8/22/2026 09:07:55
PHPRunner General questions
I
 ianweithers author

Can requests users connecting from trusted internal IP addresses or specific ip addresses be exempted from 2FA so that they don't receive the second-factor prompt, while everyone else still uses 2FA.
ChatGPT 8/22/2026

Yes, it is possible to exempt users connecting from trusted internal IP addresses or specific IP addresses from two-factor authentication (2FA) in PHPRunner. However, this requires some custom coding or configuration adjustments since PHPRunner does not have a built-in feature for IP-based 2FA exemption.

Here’s a general approach to implement this:

  1. Identify Trusted IP Addresses: Create a list of trusted IP addresses from which you want to exempt users from 2FA.


  2. Modify the Login Process: You will need to customize the login process in your PHPRunner application. This usually involves editing the login script.


  3. Check the User’s IP Address: Before prompting for the second factor (e.g., SMS code or email verification), check the user's IP address against your list of trusted IPs.


  4. Bypass 2FA for Trusted IPs: If the user’s IP address matches one of the trusted IPs, skip the 2FA prompt and log the user in directly. If it does not match, proceed with the standard 2FA process.



Here is a simple example of how you might implement this logic in PHP:

function isTrustedIP($ip) {
 $trustedIPs = ['192.168.1.1', '192.168.1.2']; // Add your trusted IPs here
 return in_array($ip, $trustedIPs);
}

// Get the user's IP address
$userIP = $_SERVER['REMOTE_ADDR'];

if (isTrustedIP($userIP)) {
 // Bypass 2FA and log the user in
 // Your login logic here
} else {
 // Proceed with 2FA
 // Your 2FA logic here
}
  1. Testing: Make sure to thoroughly test the implementation to ensure that users from trusted IPs are correctly exempted from 2FA while others are still prompted.

  2. Security Considerations: Keep in mind that exempting users from 2FA based on IP addresses can pose security risks, especially if those IPs can be spoofed or if an attacker gains access to a trusted network. Always consider the security implications and have other security measures in place.


By following these steps, you should be able to set up an exemption for specific IP addresses from 2FA in your PHPRunner application.
Sergey Kornilov admin 8/24/2026

Here is what you can try in BeforeLogin event.

This, of course, can be modified, to use a list/array of addresses or some more complex logic to check for the range of addresses.

$ip = "127.0.0.1"; // change this to the actual IP address

if ($_SERVER['REMOTE_ADDR'] == $ip && Security::checkUsernamePassword($username, $password))
{
Security::loginAs($username);
header("Location: menu.php");
exit();
}

return true;
D
 		druck281 8/26/2026

I added something similar recently but it is a little different approach. I am not bypassing 2FA but I am only allowing the 'Remember Machine' option from trusted IPs. That at least maintains the 2FA protection and it forces it from non-trusted IPs on each login but allows trusted IPs to mute it for 30 days.

It has been working well so far. I store a text field in a table called sys_GlobalSettings that allows me to manage the trusted IPs from the Administrator account.

On the login page in the BeforeDisplay event, I test to see if the IP is on the list and set a proxy value

/**
* This block checks to see if the organization has defined trusted IP addresses from
* which users can select 'Remember Device' to mute the 2FA for 30 days. If the IP is
* on the list, the checkbox appears as normal but if not, the checkbox is hidden in
* the JS OnLoad event
*/
$clientIp = $_SERVER["REMOTE_ADDR"];

$settings = DB::Select(
"sys_GlobalSettings",
array("idsys_GlobalSettings" => 1)
)->fetchAssoc();

$trustedIpString = trim($settings["trusted_ips"] ?? "");

$trustedIps = array();

if ($trustedIpString !== "") {
$trustedIps = array_map(
"trim",
explode(",", $trustedIpString)
);
}

$allowRememberMachine = in_array(
$clientIp,
$trustedIps,
true
);

// Pass result to JavaScript
$pageObject->setProxyValue(
"allowRememberMachine",
$allowRememberMachine
);

In the JSOnLoad event, I then hide the checkbox for 'Remember Machine'


//Use this code to hide the 'Remember Device' checkbox on untrusted network
//Proxy value is evaluated on the BeforeDisplay event
var allowRememberMachine = pageObj.proxy["allowRememberMachine"];

if (allowRememberMachine !== true) {
$('[data-itemtype="remember_machine"]').hide();
}