note 88004 deleted from function.md5 by danbrown
| From: | danbrown@php.net | Date: | Mon, 05 Jan 2009 20:22:52 +0000 |
| Subject: | note 88004 deleted from function.md5 by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-148865@lists.php.net to get a copy of this message | ||
Note Submitter: jwohlers at waubonsee dot edu
----
sandaimespaceman, using the IP address of the client is a really bad idea. There are network
configurations where the clients ip address will change countless times throughout the session. In
those cases your users will have to re-authenticate constantly, and get VERY upset with you. I
deal with this issue on a regular basis, please don't do it.
Example:
My college uses a pooled collection of IP addresses when connecting to the outside world. The IP
addresses are set to rotate at a rate of ~30 seconds. This means that to your server I will always
appear to come from a different REMOTE_ADDRESS and break your cookie every time.
Again, and I cannot stress this enough to developers, NEVER rely on the IP address remaining static
in a given session.