Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
In writing a login module, I want to log IP’s as an additional measure for verifying who’s on the other side is still the same person on the other side.
I’m using $_SERVER['REMOTE_ADDR'] as one (of many) ways to get the remote machine’s IP address. Aside from an IPv4 or IPv6 address, are there any other values i should expect this to return?
There’s really no added security to checking IP addresses as these can be easily spoofed and anyone who’s savvy enough to be intercepting POST transactions is probably doing this anyways.
Also, you may be potentially annoying legitimate users. Think of the instance where a person may be in a location where there are several free open wifi hotspots. When they get to your login page, they may be connected to one hotspot but by the time they sign in, their machine may have decided another router is a better option and therefore their IP will change. Believe it or not, this may deter some (albeit, very few) easily-frustrated users.
Honestly, I just wouldn’t bother. Using SSL, if you can, is usually the best way to go to avoid security issues like the one you’re describing. Good luck with your project.