Re: Linking a cookie to an IP address is a very bad in 2015...

[Max Bruce <[e-mail]>]

That isn't an issue for a session that's supposed to end 5 minutes or so
after it begins.

On Sat, Apr 4, 2015 at 9:12 AM, Jim Manico <[e-mail]> wrote:

> In the world of auto-updating browsers and therefor auto-updating
> user-agents, tying authentication to a user agent could have unintended
> negative consequences.
>
> Tying authN to an IP address also has negative unintended consequences,
> like being on a mobile network while traveling, or being behind certain
> gateways - your IP address may change in short timespans.
>
> --
> Jim Manico
> @Manicode
> [phone]
>
> On Apr 4, 2015, at 3:18 AM, Max Bruce <[e-mail]> wrote:
>
> The session ID is a cookie, so in the headers. And yes, because it also
> checks that cookie, which is randomly generated. It just enforces a
> user-agent server-side. It DID enforce an IP, but I removed this for other
> reasons discussed earlier.
>
> On Sat, Apr 4, 2015 at 2:49 AM, Walter H. <[e-mail]>
> wrote:
>
>>  let me ask it different:  where is the Session ID, is it part of a
>> http-header, part of a html-header, a session-cookie, or is it part of the
>> URL itself that is requested?
>>
>> the second: two ident configured hosts behind NAT do not differ neither
>> in the user agent nor in the IP address; they only differ in the source
>> TCP-port ...
>>
>> On 03.04.2015 09:13, Max Bruce wrote:
>>
>>  When you say transmitting from host to server, what do you mean?
>>  And yes, if I understand what your asking. It effectively compiled a
>> random hash, and then enforced an IP & user agent. I have recently removed
>> the IP enforecement though.
>>
>> On Fri, Apr 3, 2015 at 12:10 AM, Walter H. <[e-mail]>
>> wrote:
>>
>>  On 01.04.2015 21:48, Max Bruce wrote:
>>
>> What about linking to several? I wrote a session system for my Web Server
>> that will only allow access to the original Session ID if the IP &
>> User-Agent has remained unchanged, in order to protect against session
>> hijacking. I've found it's highly effective, unless you IP Spoof.
>>
>> what kind of mechanism do you use for transmitting the Session ID from
>> host to server?
>> does it prevent access from an ident configured but different host behind
>> a NAT?
>>
>>
>>
>>
>