I read different articles on the subject (Spoofing IP address), someone said:
Spoofing an IP is usually better suited to "fire-an-forget" scenarios like DDoS.
due to TCP two-way communication and its three-way handshake. That's okay but I've a scenario that I think is similar to this. Here it is:
A bug was recently found on my website in which a user could steal my paid contents by sending a
POST request to one specific URL with an old and successful purchase information (user had to buy a product once/had to have a successful payment info) then he had access to content as system didn't check if current billing information is existed or not (It only checked if a purchase with that information was done successfully or not).
After finding this bug I restricted
POST requests to get processed from a specific IP only (which is bank website IP) (and I didn't fix the logic of checking purchase information yet).
Now It came to my mind that if someone can fake his IP address as the bank IP address and gets access to my paid contents as before or not.
Is there any way that someone spoofs the request IP address here? if yes how?