Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP saved into the Session is the IP of a successfully authenticated client stored previously. If the IP it's different, request gets blocked. Now Assuming that I have a ServerA, which it's able to send requests to ServerB and ServerB have whitelisted the IP of ServerA, is possible for a third user spoof and clone the IP of ServerA in order to make valid the request (because authorized) even if it shouldn't be? If yes how can change my system in order to make it secure in this aspect?
EDIT: Security check has changed as follows: I removed the IP check and I introduced a hash that it's saved in a session variable when a user logs in, then it will be printed by the page. Next, when a user tries to request with its PHPSESSID, the script (on serverB) verifies the correspondence of the hash variable given in input with hash saved into the session at the login time. If this check doesn't pass, the session gets destroyed. Else my serverA with the PHPSESSID and the right hash could perform my request. It's the best I can think to reach the goal in this case, what do you think about this other solution?
