Magento 1.9如何限制客户账户仅从固定IP登录？

Hey there! I get that you're stuck on restricting specific Magento customer accounts to only log in from your office's fixed IPs—since .htaccess isn't an option and Google searches haven't turned up something actionable, let's walk through a straightforward, safe solution that doesn't require deep Magento expertise:

We'll use Magento's native event observer system, which is the safest way to add custom functionality without breaking core files. Here's exactly what to do:

First, create these folders/files in your Magento root directory (replace YourVendor with a unique name like your company's initials to avoid conflicts):

• app/code/YourVendor/RestrictCustomerIP/
  • etc/module.xml
  • etc/events.xml
  • Observer/RestrictCustomerLogin.php

File 1: module.xml (Registers the Module) #

Paste this code into the file:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="YourVendor_RestrictCustomerIP" setup_version="1.0.0">
        <sequence>
            <module name="Magento_Customer"/>
        </sequence>
    </module>
</config>

File 2: events.xml (Listens for Customer Login) #

This tells Magento to run our code right after a customer logs in:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Event/etc/events.xsd">
    <event name="customer_login">
        <observer name="restrict_customer_ip_login" instance="YourVendor\RestrictCustomerIP\Observer\RestrictCustomerLogin"/>
    </event>
</config>

File 3: RestrictCustomerLogin.php (The Actual Restriction Logic) #

This is where we define which customers are restricted and their allowed IPs. Paste this code, then edit the marked section to match your needs:

<?php
namespace YourVendor\RestrictCustomerIP\Observer;

use Magento\Framework\Event\Observer;
use Magento\Framework\Event\ObserverInterface;
use Magento\Customer\Model\Session;
use Magento\Framework\Message\ManagerInterface;
use Magento\Framework\App\ResponseFactory;
use Magento\Framework\UrlInterface;

class RestrictCustomerLogin implements ObserverInterface
{
    protected $customerSession;
    protected $messageManager;
    protected $responseFactory;
    protected $url;

    // Inject required tools we need to handle sessions, messages, and redirects
    public function __construct(
        Session $customerSession,
        ManagerInterface $messageManager,
        ResponseFactory $responseFactory,
        UrlInterface $url
    ) {
        $this->customerSession = $customerSession;
        $this->messageManager = $messageManager;
        $this->responseFactory = $responseFactory;
        $this->url = $url;
    }

    public function execute(Observer $observer)
    {
        // Get the currently logged-in customer
        $customer = $this->customerSession->getCustomer();
        if (!$customer->getId()) {
            return; // Skip if no customer is logged in
        }

        // --------------------------
        // ✏️ EDIT THIS SECTION FOR YOUR NEEDS
        // Map customer IDs to their allowed office IP addresses
        // Find customer IDs in your Magento Admin > Customers > All Customers (look for the ID column)
        $restrictedCustomers = [
            123 => ['192.168.1.100', '192.168.1.101'], // Customer #123 can only log in from these two IPs
            456 => ['10.0.0.5'], // Customer #456 is limited to a single office IP
            // Add more customer ID/IP pairs here as needed
        ];
        // --------------------------

        // Get the IP address of the current user
        $currentIp = $_SERVER['REMOTE_ADDR'];

        // Check if this customer is in our restricted list
        if (isset($restrictedCustomers[$customer->getId()])) {
            $allowedIps = $restrictedCustomers[$customer->getId()];
            // If their IP isn't allowed, log them out and show an error
            if (!in_array($currentIp, $allowedIps)) {
                $this->customerSession->logout();
                $this->messageManager->addErrorMessage(__('You are not permitted to log in from this IP address. Please use your office network.'));
                $redirectUrl = $this->url->getUrl('customer/account/login');
                $this->responseFactory->create()->setRedirect($redirectUrl)->sendResponse();
                exit;
            }
        }
    }
}

Run these commands in your Magento server's terminal (if you're not familiar with terminal access, ask your hosting provider to help):

bin/magento module:enable YourVendor_RestrictCustomerIP
bin/magento setup:upgrade
bin/magento cache:clean

• Log in with a restricted customer account from your office IP: it should work normally.
• Try logging in from a different IP (like your phone's hotspot): you should be logged out immediately and see the error message.

Bonus Tip (For More Flexibility) #

If you want to manage the allowed IPs directly from the Magento Admin (instead of editing code), you can add a system configuration section. But for most non-experts, the hardcoded list above is simpler and reliable.

内容的提问来源于stack exchange，提问作者Rubén Martín