why MAC address can not be used as session identifier instead of session ID?
why the physical address (MAC address) cannot be used as a session identifier during the communications between servers and client?
Add a comment
|
2 Answers
The MAC address is an identification of the specific network card at layer 2 (data-link layer). It stays only constant within the local network where no routers are involved. Once the traffic crosses a router the original MAC address is lost, i.e. the packets now have the source MAC address of the router. And if the packet is transferred by another router the MAC address is replaced again.
Given that in typical setups server and client are not within the same local network, the server has thus no knowledge of the clients MAC address at all and thus cannot use it as an identifier for the client.
answered Oct 4, 2018 at 4:30
In addition to what Steffen Ullrich said about the server not being able to see the MAC address if the client and server are not on the same network, there's another problem: there's no way to guarantee that MAC addresses are unique. On most systems, the MAC address for a network interface is easy to configure, so you it would be trivial to change your session ID.
Lastly, you would want something that is unique to the visitor, not something that is unique to the machine he's using. There are plenty of virtual desktop infrastructures (like Citrix) where people run their applications (like a webbrowser) on a central server. In these cases you wouldn't be able to distinguish different users.
