Re: How can i protect against session hijacking?

[Robin Wood <dninja () gmail com>]

2009/3/28 Marco M. Morana <marco.m.morana () gmail com>:
> 2) Using remote IP for validation. This is all cons. IP address can be
> spoofed easily. Also if you use this as a form of authentication as machine
> tagging you will be defeated by an attacker
> using a proxy in the middle to hide the source IP address. You should never
> rely on this form of authentication, except maybe for internal low risk
> applications

I can understand how with a mitm attack you can spoof your IP but
remotely I wouldn't say that it was easy.

Having said this, I agree that relying on IP is a bad idea.

Robin