Implement geolocation-based restrictions for web apps

[jmrossy]

Use Vercel's IP Geolocation service to restrict web app access for certain countries.

Comply with OFAC Comprehensively Sanctioned Countries List: Cuba, Iran, North Korea, Russia (and the following regions of Ukraine: Crimea, Donetsk and Luhansk), Syria

Comply with UK: Afghanistan, Belarus, Bosnia & Herzegovina, Central African Republic, Democratic Republic of the Congo, Guinea, Republic of Guinea-Bissau, Haiti, Iraq, Lebanon, Libya, Mali, Nicaragua, Somalia, South Sudan, Sudan, Venezuela, Yemen, Zimbabwe

Comply with FATF: Myanmar

Relevant resources:

https://vercel.com/docs/concepts/edge-network/headers#request-headers?utm_source=geo-ip-demo&utm_campaign=geo-ip-demo

https://github.com/vercel/examples/tree/main/edge-middleware/geolocation-country-block

https://edge-functions-geolocation.vercel.sh/

[AlexBHarley]

Summarising approaches here,

Cloudflare

• Simple to configure via CF dashboard
• Need a business plan to set region specific WAF rules
• Each Warp deployment needs to configure individually
• Typical "You have been blocked" CF page isn't bad

Vercel middleware

• Configuration lives in codebase so all deployments can share (example implementation)
• Fairly cheap, $1.5 - $2.1 per M requests with 1M free
• Need to build our own "You have been geo blocked" page