Re: AOL problem with remote IP address

I haven't heard about address' changing midway through a session (ie, without reconnecting), but it's worth pointing out that there will be a few other reasons why this isn't a good idea: 1. if they have to reconnect, they're near guaranteed to have a new IP 2. with most big ISPs, all users may *appear* to have the same IP... so any of them could hijack the session? The only way to test if IPs ARE changing is to get/borrow an AOL account, and create a page which you can refresh 30 times over an hour, looking at the IP address' each time. That should confirm/deny the problem. But I wouldn't be relying on a remote IP for anything... they're too unreliable. Justin French on 29/08/02 7:29 AM, Joseph Szobody (jszobody@excite.com) wrote: > In a portion of a website, I have implemented user authentication and > management using sessions. When a user first logs in, the $REMOTE_ADDR is > stored is a session variable SESSION['ip']. On each of the protected pages, a > header.php is included with the following code: > > if ($SESSION['ip'] != $REMOTE_ADDR){ > header("Location: error.php?err=2"); > die; > } > > As you can see, this is an attempt to see if someone is trying to hijack a > session. The problem is, AOL doesn't like this. Whenever an AOL user logs into > the website, the session starts successfully, but when the user goes to a > protected page, he's redirected to error.php?err=2. For some reason, the IP > address appears to be changing. > > Is this a known issue with AOL? Is the IP really changing from page to page? > That seems weird. Any way around this, or must I stop using this security > approach? > > Thanks,