RE: Session Management and IP address - experiences?

["Harry Metcalfe" <harry () slaptop com>]

When I wrote the session management stuff for a website of mine a year or so
ago, I bound the IP address to the session and invalidated sessions when the
IP changed. After a couple of months, I stopped checking the IP - I
receieved many complaints. It was a serious inconvinience for more people
than I expected. I came to the conclusion that because of ISP proxies (AOL -
grrr!) and soforth, the IP changing isn't a reliable indication that session
theft has occurred anyway.

Harry Metcalfe