PHP locked ip address

Question

I lock the ip address.

Does this mean than user can only login in with the same ip address? Or will the user logout and have to re-login to get a new session?

if (isset($_SESSION['last_ip']) === false) {
    $_SESSION['last_ip'] = $_SERVER['REMOTE_ADDR']; 
}

if ($_SESSION['last_ip'] != $_SERVER['REMOTE_ADDR']){
    session_unset();
    session_destroy();  
}

score 13 · Accepted Answer · edited Jan 27 '16 at 19:56

13

This code will delete the session (logout) if the user's IP address changes.

So the user can log in from any IP address, but will be logged out if it changes.

This could work to prevent session hijacking, but it wont work very well if you're on a dynamic IP because your IP will keep changing.

edited Jan 27 '16 at 19:56

Maytham Fahmi

31,138
14
118
137

answered Apr 09 '13 at 10:04

Halcyon

57,230
10
89
128

if session deleted, will user be able to get new session from new ip if they log in – chien pin wang Apr 09 '13 at 10:05
i have add session_regenerate_id(true); so how is these 2 work together? – chien pin wang Apr 09 '13 at 10:07
3

`session_regenerate` will give the user a new `session_id`. Sessions are identified by the `session_id`, the user sends this as a cookie. When you regenerate the session you're telling the user to send a different `session_id` from now on. The session data will remain the same and aside from some edge cases this is pretty transparent (ie. the user will not notice). – Halcyon Apr 09 '13 at 10:10

score 9 · Answer 2 · edited May 23 '17 at 12:14

It does. If the user's IP changes, he'll be logged out. Although an attacker could still mimic the IP if he knows it, so it's not totally secure. Take a look at these pages for more information on how to prevent session hijacking:

I'd also highly recommend Chris Shiflett. His article on session hijacking can be found here:

http://shiflett.org/articles/session-hijacking

score 1 · Answer 3 · answered Jan 27 '16 at 06:28

if (isset($_SESSION['last_ip']) === false) {
    $_SESSION['last_ip'] = $_SERVER['REMOTE_ADDR']; 
}

Above code means if session "last_ip" is not created yet, it will be created and stores values of user's current ip.

if ($_SESSION['last_ip'] != $_SERVER['REMOTE_ADDR']){
    session_unset();
    session_destroy();  
}

Above code indicates that if session value of "last_ip" is not equal to your current ip, it will free all session variables(session_unset) and destroy all data registered to a session (session_destroy).

Let's describe real scenario.

e.g. I access your website so first block of code stores my current ip. Now my internet got disconnected and I reconnect to my isp which has dhcp enabled and gives new ip to me. So if visit your website again, second block of code checks that I have different IP so it will log me out.

Also edit your second block of code to this so that if session "last_ip" is not created yet, it won't throw php notice.

if (isset($_SESSION['last_ip']) && $_SESSION['last_ip'] != $_SERVER['REMOTE_ADDR']){
    session_unset();
    session_destroy();  
}

PHP locked ip address

3 Answers3