note 88278 added to session.security

IP checking is a sometimes useful feature with two limitations that are important to be aware of: 1. Anyone surfing behind a proxy (e.g., someone at work) will provide the proxy's IP, not his own. Session ID replay attacks will not be prevented by IP checking for an attacker on the user's side of the proxy. 2. If the PHP application is behind a reverse proxy, the reverse proxy's IP address will be the only request IP seen by PHP, so IP checking is useless. ---- Server IP: 216.235.13.26 Probable Submitter: 24.82.154.249 ---- Manual Page -- http://www.php.net/manual/en/session.security.php Edit -- https://master.php.net/note/edit/88278 Del: integrated -- https://master.php.net/note/delete/88278/integrated Del: useless -- https://master.php.net/note/delete/88278/useless Del: bad code -- https://master.php.net/note/delete/88278/bad+code Del: spam -- https://master.php.net/note/delete/88278/spam Del: non-english -- https://master.php.net/note/delete/88278/non-english Del: in docs -- https://master.php.net/note/delete/88278/in+docs Del: other reasons-- https://master.php.net/note/delete/88278 Reject -- https://master.php.net/note/reject/88278 Search -- https://master.php.net/manage/user-notes.php