Home page logo

webappsec logo WebApp Sec mailing list archives

Re: Session Management and IP address - experiences?
From: Bill Marquette <bill.marquette () gmail com>
Date: Thu, 2 Sep 2004 21:00:21 -0500

Forget it if you plan on having users from large ISPs (AOL) using your
application.  Further, many corporate environments load balance
outbound browsing.


On Thu, 2 Sep 2004 14:53:58 +0200, Thomas Schreiber <ts () secure-net de> wrote:
A question about their experiences to those people that are running web
applications with the clients ip address bound to the session. I.e. when
creating a session, the client-ip is stored and then compared with every
request. Only if the client-ip has not changed, the request is accepted as
beeing part of the session.

It is common knowledge, that things like loadbalanced proxies, where the ip
address might change within a running session, interfere with this kind of
security enhanced session management.

But, how strong is the impact in practice really nowadays?

Is it perhaps exceptable, as it happens only in rare cases? If this is the
case, one might present the user another login where he can prove his
identity again and continue with the session.

(It is another story that session-ip-binding wouldn't solve the whole
problem, as there are several szenarios, where an attacker might use the
same proxy etc. as the victim...)

Thomas Schreiber
SecureNet GmbH - http://www.securenet.de

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]