Ip address restriction action filter

RestrictByIpAddressAttribute.cs

using System;
using System.Collections.Generic;
using System.Configuration;
using System.Linq;
using System.Web;
using System.Web.Mvc;

namespace Web.Attributes
{
    public class RestrictByIpAddressAttribute : ActionFilterAttribute
    {
        private IEnumerable<string> _allowedAddresses;

        public RestrictByIpAddressAttribute(string appSettingName)
        {
            GetConfig(appSettingName);
        }

        private void GetConfig(string appSettingName)
        {
            var addresses = (ConfigurationManager.AppSettings[appSettingName] ?? "")
                .Split(new string[] { " ", ";", ",", "\t" }, StringSplitOptions.RemoveEmptyEntries);

            _allowedAddresses = new List<string>(addresses);
        }

        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            base.OnActionExecuting(filterContext);

            var clientIpAddress = GetIpAddress();
            if (String.IsNullOrWhiteSpace(clientIpAddress) || (!_allowedAddresses.Contains(clientIpAddress)))
                filterContext.Result = new ContentResult() { Content = "ACCESS DENIED" };
        }

        /// <summary>
        /// Returns the current visitor's IP address. This method is more reliable than UserHostAddress because
        /// it works in conjunction with a load balancer, whereas UserHostAddress won't.
        /// </summary>
        /// <returns></returns>
        public static string GetIpAddress()
        {
            if (HttpContext.Current == null || HttpContext.Current.Request == null)
                return null;

            // this code gets the IP address. Cannot use "UserHostAddress" here
            // because the load balancer changes the IP address
            string ipAddress = (HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] ?? "").Trim();
            if (!String.IsNullOrWhiteSpace(ipAddress))
            {
                // see this: http://www.jamescrowley.co.uk/2007/06/19/gotcha-http-x-forwarded-for-returns-multiple-ip-addresses/
                // can sometimes include multiple addresses (CSV) in the case of complicated load balancing rules
                // so pick out the last one
                if (ipAddress.Contains(","))
                    ipAddress = ipAddress.Split(',').Last();
            }

            // fall back to REMOTE_ADDR server variable
            if (String.IsNullOrWhiteSpace(ipAddress))
                ipAddress = HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];

            // ultimately fall back to UserHostAddress
            if (String.IsNullOrWhiteSpace(ipAddress))
                ipAddress = HttpContext.Current.Request.UserHostAddress;

            return ipAddress;
        }
    }
}