48

Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server.

Why aren't sessions always exclusive to the IP they were started on? i.e., when would a website/service need to persist an authenticated session across multiple IP addresses? I'm not sure why sessions permit this, thus I don't understand how this is ever a feasible route for an attacker.

  • 32
    An IP address is not a reliable way to identify a user. – Michael Hampton Oct 17 '16 at 13:19
  • 74
    So if I'm on my phone and get out of my house (losing wifi but connecting to 4G) I should lose all my sessions? – Najib Idrissi Oct 17 '16 at 14:08
  • 7
    @NajibIdrissi Not just phones, but laptops also. Take your laptop someplace else, lose sessions on all website? No thanks. – marcelm Oct 17 '16 at 14:53
  • 15
    XSS attacks inject code into the user's browser, and thus even forged requests originate from the same IP as the user. – jpaugh Oct 17 '16 at 18:03
  • 3
    @AndréBorie Not 'scammy' behavior in the slightest- the proper term is dynamic IP addressing and changes when the lease expires (often when the router is rebooted). Dynamic IP addressing is far cheaper than using static IPs, and are mostly used for residential broadband packages; if you want a static address, you must ask the ISP or move to a business package. – AStopher Oct 18 '16 at 14:56
81

First, linking a session to an IP address will not make it secure since the server could see many different users as using the same IP address for various reasons (all types of proxy servers, for instance: client, reverse proxy, CDN, etc.).

Second, the same user could very well use different IP addresses for the same session. For instance, someone could be switching between networks from the same device.

So, since it's not effective and it causes usability and scalability issues, that is not an feature that is usually enabled.

  • 4
    I do agree with you, but some servers implement IP session stickyness. I can confirm that I loose my session on stackexchange network each time I change proxy... – Serge Ballesta Oct 17 '16 at 9:15
  • 8
    @SergeBallesta That is weird: I don't see that. – Stephane Oct 17 '16 at 9:23
  • 2
    Just providing a live example. Not refuting your reasoning. – Bob Oct 17 '16 at 12:52
  • 5
    @SergeBallesta: I can't speak to StackExchange, but I maintain a site which uses sessions heavily. The session itself isn't tied to IP address, but the servers live behind a load balancer which uses "sticky sessions" - your IP address will go to the same server for ... ever. But, session state isn't shared between the servers, so if your IP address changes, you get a new session. – minnmass Oct 17 '16 at 17:36
  • 4
    Also users may naturally switch networks. Someone walking around with a mobile phone may switch between different WiFis and the mobile network a lot. – viraptor Oct 17 '16 at 23:02
14

Back in the day, AOL was notorious for aggressively load-balancing traffic between its internal network and the Internet across all its exit proxies. This meant that a request for a single web page and its content would come from many different IP addresses: if you pinned a session to a single IP address, the session would break before the "login successful" page finished loading.

This sort of load balancing is less common, but can still happen if someone is using a "web accelerator" proxy or a less-technically-inclined ISP. Slower shifts are more common, such as if someone is using a wireless ISP and gets a new address every time they change base stations.

Pinning a session to a single IP address can make session-stealing attacks harder, but it comes at the cost of preventing some people from using your service entirely, and giving others a degraded experience.

10

An attacker can connect to the server from the same address. For example an attacker and the victim are using the same WiFi.
Also, it can cause problems to the user if he/she has multiple routes to the server and the user's IP undergoes Network Address Transition.

  • 3
    WiFi as a vector doesn't preclude using IPs for security, since it would still severely limit the effectiveness of a single attacker (limited to several WIFI networks/1 geographic area, e.g.); however, IPs don't protect against XSS attacks at all, because the attacker always uses the same browser as the user to forge requests. – jpaugh Oct 17 '16 at 18:06
  • 1
    @jpaugh XSS could also result in data leaks, such as giving the attacker the session ID to be used elsewhere. Of course, this is largely solved by the use of httponly cookies. – Bob Oct 17 '16 at 22:51
  • 1
    I wouldn't say that the statement "An attacker can always connect to the server from the same address" is likely to be true, it may be the case but definitely not all the time. – Rory McCune Oct 19 '16 at 15:12
  • @RоryMcCune , yes you are absolutely right. I meant it in a way to show that the likelihood of this happening is not rare. I have edited it though now. – one Oct 20 '16 at 6:31
6

Another reason against binding sessions to a specific IP address is a thing called "Happy eyeballs" (yes, really!).

It is basically a mechanism which tries to detect the best way of establishing a connection when using a Dual-Stack connection (IPv4 and IPv6 supported).

Some OSes do this very aggressivly, OS X for example will even (for example) try to load the webpage it self via IPv6 and then load some images via IPv4 to get a benchmark of which works better.

And of course, as IPv4 and IPv6 use completly different addresses which you can't correlate, really strange things would happen, when you'd bind IP addresses to sessions.

More information: https://en.wikipedia.org/wiki/Happy_Eyeballs

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy