Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I know we have some extra advantages in using the cookies over IP address, but my question is Why can't the container just remember the IP address of the client in identifying the client when he visit his site again? Is it possible for the container to remember the client with the help of IP address?

share|improve this question
42  
IP addresses aren't unique. What happens when two people are behind the same router? –  Doval Aug 14 at 16:52
6  
What happens when one person is using Tor? –  MichaelT Aug 14 at 16:54
11  
And people's IP addresses might change frequently (home broadband). –  GrandmasterB Aug 14 at 16:54
6  
Proxies show up as 1 IP address, regardless of how many people are behind them, for example everyone at a company. –  Jeff-Inventor ChromeOS Aug 14 at 18:24
4  
@Jeff-InventorChromeOS And vice versa, too: some ISPs have clusters of proxy servers such that a single user's requests can appear to come from multiple IP addresses. Last time I checked, AOL did this, for instance. –  Jules Aug 17 at 20:46

4 Answers 4

up vote 69 down vote accepted

A client is identified by a cookie as well as the IP address. However, the IP address cannot be used exclusively:

  • What if two clients are located behind the same NAT firewall or proxy? They will have the same external IP address to the server.
  • What if a user has two different browsers open on the same machine, and wants two separate sessions (maybe for testing?)
  • A user may have a dynamic IP address which conceivably could change during a session.
  • An attacker may be able to spoof an IP address and take over a session if it relied on IP address alone.

This means an IP address does not uniquely identify a client in all cases.

share|improve this answer
16  
Using an IP address at all to identify a client is a huge bug. My IP address probably changes several times a minutes while walking down the street accessing a site from my phone. –  R.. Aug 14 at 22:25
3  
@R.. I am sorry, but this is blatantly wrong. Your radio cell has nothing to do with your IP address, the IP layer is above cell communication (using the physical layer) in the OSI model. Still, using IP address to identifying clients is still wrong, but not for this reason. –  dirkk Aug 15 at 8:57
9  
@dirkk If he's on WiFi and connecting to different, independent, networks with their on public IPs, that can certainly happen. A mobile network could also decide to provide different IP addresses when you change cells. If I plug (layer1) my laptop into a different network, that could certainly change my IP (layer3). –  Bob Aug 15 at 10:37
7  
I am no expert on how wireless telcos assign IP addresses, but I can speak to the wifi: if I were walking down a busy street and I had my wireless device configured to connect to any and all wifi network it could, I would fully expect its wifi IP address to change frequently. –  Snowman Aug 15 at 11:21
4  
@dirkk: Please don't accuse me of being wrong about something you have no idea about. As Bob suspected, I was talking about wifi. I have access to 8+ cafes and other business access points, plus (lower-quality) city-provided wifi access points along the street, and my phone regularly jumps between them while walking. –  R.. Aug 15 at 14:52

Sometimes you can use IP address.

If you're on a LAN or are otherwise dealing exclusively with users that have IP's statically distributed to single clients, using that address is perfectly fine -- sometimes preferable and necessary.

But, usually you can't.

If you're running a public site, most of the IP addresses that hit your server aren't static or dedicated. Most of them represent multiple clients: Your desktop, laptop, and cellphone all go out over the same IP address when you're on your home network. And that IP can change -- even mid-session.

share|improve this answer

Three more reasons to add:

  1. Multiuser workstations and terminal servers exist. Many users could be running completely independent browser processes in separate sessions.
  2. IP addresses aren't persistent. It could be reassigned when a DHCP lease expires.
  3. The application should support roaming. For example, a user on a phone might drop out of WiFi range and get handed off to a 3G connection. The IP address would change, but it would be nice to let the web application keep working.
share|improve this answer

Using IP address as identifier is generally not recommended, as it is not what IP address is meant for - functionally it is a plain address for routing from a to b, and it tells nothing what is before a or after b.

In example, same IP address may be shared by a number of natted devices, most common cases being

a) a provider dynamically assigning a pool of addresses to its customers, that is quite common as buying the same quantity of public adresses you can serve more customers (you need just enough addresses for simultaneous users, not total users)

b) a private network accessing the web from a single address, internally redirecting packets to hundreds or thousands if machines

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.