We're using a cloud based web security (proxy) service which basically takes our web requests, scans them and NATs these requests to their public IP addresses. NAT is being done on a per-session basis, whatever that means in detail.
We now have a problem with a third party service which is essentially doing something like this:
- User goes to URL A (TLD 1) and logs in there
- The login then sets a cookie with no domain set (so its only valid for this domain)
- It 302 redirects the user to another Domain URL B, and sets some token as GET parameter
At this point the session is rejected with an error message that the public IP does not match (for the proxy its a new session, thus a new IP address is used when NATing this to the outside)
For me this looks like a way to authenticate the user on one site and using services on another without implementing some proper authentication framework.
Is this IP address check adding any (noteworthy) security? This seems to be a setting we cannot change on the security provider side, so we may need to convince the provider to change this model.