0

I'm programming a HTTP server. It remembers the logged in users using their IP addresses. It works fine on private network with 192.168.... IPs. But when I roll it out to the public server and connect via Google Chrome I notice that my client IP is changing in the middle of a page request. It's not happening once a day or so, but all the time. So my service can't do its job properly, because the user is constantly being "logged out".

Can someone please explain how and why this is happening? My best guess is that the ISP is giving me a new dynamic IP. I know from home that the IP is not changing that often. But now I'm at work and there are lots of other users going out to the internet.

In case this is totally normal, what can I do to remember my clients?
Is working with IP addresses wrong? Do I have to use cookies or sessions?

Server-Logs:

04:41:50: server started at 1__.1__.1__.1__:80 04:42:56: client connected: 217.224.68.88:28439 04:42:56: -> GET request: / 04:42:56: client connected: 217.224.68.88:28437 04:42:56: client connected: 217.224.68.88:28436 04:42:56: client connected: 217.224.68.88:28395 04:42:56: client connected: 217.224.68.88:28438 04:42:56: client connected: 217.224.68.88:28394 04:42:56: -> GET request: /css/style.css 04:42:56: -> GET request: /js/basics.js 04:42:56: -> GET request: /js/login.js 04:42:56: -> GET request: /js/md5.js 04:42:56: -> GET request: /js/script.js 04:42:56: client connected: 217.91.48.78:28396 04:42:56: -> GET request: /js/tree-view.js 04:42:56: client connected: 217.224.68.88:28399 04:42:56: -> GET request: /js/sprites.js 04:42:57: client connected: 217.91.48.78:28397 04:42:57: -> POST request: LoginNeeded() 04:42:57: client connected: 217.91.48.78:28386 04:42:57: -> GET request: /favicon.ico 04:42:57: client connected: 217.91.48.78:28387 04:42:57: client connected: 217.91.48.78:28384 04:42:57: -> GET request: /images/xxx-logo.png 04:42:57: -> GET request: /images/image.png

(I'm not sure if this question belongs on Stackoverflow, but I don't know any better ...)

Bitterblue
  • 13,162
  • 17
  • 86
  • 124

1 Answers1

1

Tracking users by IP address is considered bad practice. It causes a vast range of problems - for example, like in your case, IP addresses can change very easily and are inconsistent. Also, sometimes you have many users originating from the same IP address. Until recently, some countries even had one IP address allocated for the whole country.

A more common practice is to use HTTP sessions. They let you track users very accurately and a lot of infrastructure and libraries already exist for their management.

matanso
  • 1,284
  • 1
  • 10
  • 17
  • Thanks for the info. Though the wiki block you linked to doesn't speak of [HTTP sessions](http://stackoverflow.com/a/11236320/1442225) you're (probably) referring to. – Bitterblue Jul 14 '16 at 07:52