Re: Linking a cookie to an IP address is a very bad in 2015...

[Jim Manico <[e-mail]>]

It's not •likely• to be an issue for short lived sessions but it could happen.

--
Jim Manico
@Manicode
[phone]

> On Apr 4, 2015, at 1:47 PM, Max Bruce <[e-mail]> wrote:
> 
> That isn't an issue for a session that's supposed to end 5 minutes or so after it begins.
> 
>> On Sat, Apr 4, 2015 at 9:12 AM, Jim Manico <[e-mail]> wrote:
>> In the world of auto-updating browsers and therefor auto-updating user-agents, tying authentication to a user agent could have unintended negative consequences.
>> 
>> Tying authN to an IP address also has negative unintended consequences, like being on a mobile network while traveling, or being behind certain gateways - your IP address may change in short timespans. 
>> 
>> --
>> Jim Manico
>> @Manicode
>> [phone]
>> 
>>> On Apr 4, 2015, at 3:18 AM, Max Bruce <[e-mail]> wrote:
>>> 
>>> The session ID is a cookie, so in the headers. And yes, because it also checks that cookie, which is randomly generated. It just enforces a user-agent server-side. It DID enforce an IP, but I removed this for other reasons discussed earlier.
>>> 
>>>> On Sat, Apr 4, 2015 at 2:49 AM, Walter H. <[e-mail]> wrote:
>>>> let me ask it different:  where is the Session ID, is it part of a http-header, part of a html-header, a session-cookie, or is it part of the URL itself that is requested?
>>>> 
>>>> the second: two ident configured hosts behind NAT do not differ neither in the user agent nor in the IP address; they only differ in the source TCP-port ...
>>>> 
>>>>> On 03.04.2015 09:13, Max Bruce wrote:
>>>>> When you say transmitting from host to server, what do you mean?
>>>>> And yes, if I understand what your asking. It effectively compiled a random hash, and then enforced an IP & user agent. I have recently removed the IP enforecement though.
>>>>> 
>>>>> On Fri, Apr 3, 2015 at 12:10 AM, Walter H. <[e-mail]> wrote:
>>>>>> On 01.04.2015 21:48, Max Bruce wrote:
>>>>>> What about linking to several? I wrote a session system for my Web Server that will only allow access to the original Session ID if the IP & User-Agent has remained unchanged, in order to protect against session hijacking. I've found it's highly effective, unless you IP Spoof.
>>>>> what kind of mechanism do you use for transmitting the Session ID from host to server?
>>>>> does it prevent access from an ident configured but different host behind a NAT?
>