Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server.

Why aren't sessions always exclusive to the IP they were started on? i.e., when would a website/service need to persist an authenticated session across multiple IP addresses? I'm not sure why sessions permit this, thus I don't understand how this is ever a feasible route for an attacker.

  • 32
    An IP address is not a reliable way to identify a user. Commented Oct 17, 2016 at 13:19
  • 75
    So if I'm on my phone and get out of my house (losing wifi but connecting to 4G) I should lose all my sessions?
    – N.I.
    Commented Oct 17, 2016 at 14:08
  • 8
    @NajibIdrissi Not just phones, but laptops also. Take your laptop someplace else, lose sessions on all website? No thanks.
    – marcelm
    Commented Oct 17, 2016 at 14:53
  • 15
    XSS attacks inject code into the user's browser, and thus even forged requests originate from the same IP as the user.
    – jpaugh
    Commented Oct 17, 2016 at 18:03
  • 3
    @AndréBorie Not 'scammy' behavior in the slightest- the proper term is dynamic IP addressing and changes when the lease expires (often when the router is rebooted). Dynamic IP addressing is far cheaper than using static IPs, and are mostly used for residential broadband packages; if you want a static address, you must ask the ISP or move to a business package.
    – AStopher
    Commented Oct 18, 2016 at 14:56

4 Answers 4


First, linking a session to an IP address will not make it secure since the server could see many different users as using the same IP address for various reasons (all types of proxy servers, for instance: client, reverse proxy, CDN, etc.).

Second, the same user could very well use different IP addresses for the same session. For instance, someone could be switching between networks from the same device.

So, since it's not effective and it causes usability and scalability issues, that is not an feature that is usually enabled.

  • 4
    I do agree with you, but some servers implement IP session stickyness. I can confirm that I loose my session on stackexchange network each time I change proxy... Commented Oct 17, 2016 at 9:15
  • 9
    @SergeBallesta That is weird: I don't see that.
    – Stephane
    Commented Oct 17, 2016 at 9:23
  • 2
    Just providing a live example. Not refuting your reasoning.
    – Bob
    Commented Oct 17, 2016 at 12:52
  • 5
    @SergeBallesta: I can't speak to StackExchange, but I maintain a site which uses sessions heavily. The session itself isn't tied to IP address, but the servers live behind a load balancer which uses "sticky sessions" - your IP address will go to the same server for ... ever. But, session state isn't shared between the servers, so if your IP address changes, you get a new session.
    – minnmass
    Commented Oct 17, 2016 at 17:36
  • 4
    Also users may naturally switch networks. Someone walking around with a mobile phone may switch between different WiFis and the mobile network a lot.
    – viraptor
    Commented Oct 17, 2016 at 23:02

Back in the day, AOL was notorious for aggressively load-balancing traffic between its internal network and the Internet across all its exit proxies. This meant that a request for a single web page and its content would come from many different IP addresses: if you pinned a session to a single IP address, the session would break before the "login successful" page finished loading.

This sort of load balancing is less common, but can still happen if someone is using a "web accelerator" proxy or a less-technically-inclined ISP. Slower shifts are more common, such as if someone is using a wireless ISP and gets a new address every time they change base stations.

Pinning a session to a single IP address can make session-stealing attacks harder, but it comes at the cost of preventing some people from using your service entirely, and giving others a degraded experience.


An attacker can connect to the server from the same address. For example an attacker and the victim are using the same WiFi.
Also, it can cause problems to the user if he/she has multiple routes to the server and the user's IP undergoes Network Address Transition.

  • 3
    WiFi as a vector doesn't preclude using IPs for security, since it would still severely limit the effectiveness of a single attacker (limited to several WIFI networks/1 geographic area, e.g.); however, IPs don't protect against XSS attacks at all, because the attacker always uses the same browser as the user to forge requests.
    – jpaugh
    Commented Oct 17, 2016 at 18:06
  • 1
    @jpaugh XSS could also result in data leaks, such as giving the attacker the session ID to be used elsewhere. Of course, this is largely solved by the use of httponly cookies.
    – Bob
    Commented Oct 17, 2016 at 22:51
  • 1
    I wouldn't say that the statement "An attacker can always connect to the server from the same address" is likely to be true, it may be the case but definitely not all the time. Commented Oct 19, 2016 at 15:12
  • @RоryMcCune , yes you are absolutely right. I meant it in a way to show that the likelihood of this happening is not rare. I have edited it though now.
    – one
    Commented Oct 20, 2016 at 6:31

Another reason against binding sessions to a specific IP address is a thing called "Happy eyeballs" (yes, really!).

It is basically a mechanism which tries to detect the best way of establishing a connection when using a Dual-Stack connection (IPv4 and IPv6 supported).

Some OSes do this very aggressivly, OS X for example will even (for example) try to load the webpage it self via IPv6 and then load some images via IPv4 to get a benchmark of which works better.

And of course, as IPv4 and IPv6 use completly different addresses which you can't correlate, really strange things would happen, when you'd bind IP addresses to sessions.

More information: https://en.wikipedia.org/wiki/Happy_Eyeballs

You must log in to answer this question.