From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. Our idea is not new: we want a one-time validation and from that moment on allow any computer in a certain IP-range certain light-weight editing access to a website. Plus we want to be able to configure this beforehand on the server.
- I understand it is possible and easy to spoof an IP address
- A spoofed IP address cannot receive an answer from your server
- When behind a proxy or router, is there a related way that allows me to identify the user, i.e. some
Forwarded-By(or what's it called) header?
I'm particularly interested by the second item. According to Wikipedia, it is very hard but not impossible to catch the answer packet of a spoofed IP address. It doesn't specify what's needed though.
What would you recommend provided the requirement is to be able to configure this IP-based (or related)?