Regarding Session Security

[FLEB]

I've been delving into persistent sessions more, and I'm just wondering...
To prevent session-snatching (by someone else using the same session ID),
would putting the IP address as a session variable, and checking that on
every page, be an effective deterrent? This still allows for IP spoofing,
but anyone going that far can have it, as far as I care.

--
-- Rudy Fleminger
-- [e-mail]
(put "Hey!" in the Subject line for priority processing!)
-- http://www.pixelsaredead.com

[Michael Fuhr]

FLEB <so*********@mmers.and.evil.ones.will.bow-down-to.us> writes:

I've been delving into persistent sessions more, and I'm just wondering...
To prevent session-snatching (by someone else using the same session ID),
would putting the IP address as a session variable, and checking that on
every page, be an effective deterrent? This still allows for IP spoofing,
but anyone going that far can have it, as far as I care.

Whether the check you describe would be reliable and effective
depends on your environment. Do your users have a 1:1 mapping with
IP addresses? Does a particular user always use the same IP address?
These conditions may be true in certain environments, but they're
not true on the Internet.

--
Michael Fuhr
http://www.fuhr.org/~mfuhr/