Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP saved into the Session is the IP of a successfully authenticated client stored previously. If the IP it's different, request gets blocked. Now Assuming that I have a ServerA, which it's able to send requests to ServerB and ServerB have whitelisted the IP of ServerA, is possible for a third user spoof and clone the IP of ServerA in order to make valid the request (because authorized) even if it shouldn't be? If yes how can change my system in order to make it secure in this aspect?

EDIT: Security check has changed as follows: I removed the IP check and I introduced a hash that it's saved in a session variable when a user logs in, then it will be printed by the page. Next, when a user tries to request with its PHPSESSID, the script (on serverB) verifies the correspondence of the hash variable given in input with hash saved into the session at the login time. If this check doesn't pass, the session gets destroyed. Else my serverA with the PHPSESSID and the right hash could perform my request. It's the best I can think to reach the goal in this case, what do you think about this other solution?

  • 4
    Whether or not it's possible, you shouldn't rely on IP addresses for authentication. Nov 1, 2019 at 21:38
  • @multithr3at3d check the IP address it's just another layer of security in my opinion. Anyway, what do you suggest?
    – Virgula
    Nov 1, 2019 at 21:40
  • 1
    It's possible for a user to spoof his IP address, to make a request to the server appear as if it's coming from an IP other than his own. But, he wouldn't receive a response from the server, because the server would send the response back to the spoofed IP.
    – mti2935
    Nov 1, 2019 at 21:42
  • 1
    @Virgula I agree that whitelisting the server in firewall rules is a good idea, but conventional authentication over a secure channel is what should be relied on. Nov 1, 2019 at 21:43
  • 1
    Possible duplicate of Is IP whitelisting for webpage access secure enough?
    – ximaera
    Nov 2, 2019 at 22:12


You must log in to answer this question.

Browse other questions tagged .