From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. One of the reasons is obvious, multiple actual users can use the same IP address.
Our idea is not new: we want a one-time validation and from that moment on allow any computer in a certain IP-range certain light-weight editing access to a website (consider: all employees of a company that are within that range). Plus we want to be able to configure this beforehand on the receiving server.
- I understand it is possible and easy to spoof an IP address
- A spoofed IP address cannot receive an answer from your server
- When behind a proxy or router, is there a related way that allows me to identify the user/original source system, i.e. something similar to the HTTP
I'm particularly interested by the second item. According to Wikipedia, it is very hard but not impossible to catch the answer packet of a spoofed IP address. It doesn't specify what's needed though.
What would you recommend provided the requirement is to be able to configure this IP-based (or related)?