HTTP VS: Only allow specific client IP but open specific /uri for all.

You're not setting $allowed back to 0 anywhere outside of the CLIENT_ACCEPTED event. If someone goes to an authorized URI and gets it set to allowed, everything else will be allowed from then on. You'll need to add a bit to your code by setting a default case in your switch statement that sets allowed to 0 unless the IP is allowed.

 

 

Colin