4

I'm just looking through our web logs and noticed a user who logs in and appears to be using two different IP addresses as he browses the website.

ie. some of the request for images and scripts come from a different IP to the one that requested the login page.

Under what sort of setup would this occur?

1
  • 1
    I'd bet money he's behind a load balancing proxy or something similar. The answer below makes this sound nebulous or uncommon, but it's very common in larger business and institutional (schools, government, etc) settings.
    – Chris S
    Jan 21, 2013 at 3:22

2 Answers 2

4

This setup is not common, but it is also less rare than you think. It's possible in some scenarios, I can think of the following:

  • Users having more than one connection at home (for reliability or other reasons) and who use a random one for each connection (possible to set it up that way)
  • Using TOR or other VPN/anonymation services can cause users to suddenly switch IP
  • Some strange corporate/offices environments

It's something that you should definitely take into account. When I was working for a very big website I implemented a SSO (Single Sign-on) system that assumed the IP of two subsequent web requests was the same if the user was the same.

Surprisingly to me at the time, dozens of users complained of things being randomly broken, and after some investigation I discovered that all of them had more than one IP. Granted, we received millions of visitors so the percentage is very very tiny, but those people are out there and they can be "legit".

3
  • Hmm interesting. Same situation - I'm implementing some security as well assuming that the IP is the same request to request. Thanks for your answer.
    – Dan
    Jan 21, 2013 at 2:37
  • 1
    Just to name another practical scenario: Mobile devices in weak wifis that are constantly switching between cellular network and the local hotspot. This might not happen so frequently that consecutive requests are coming from different IPs, but in a longer session you will of course see the user originating from different networks. Jan 21, 2013 at 3:07
  • i have query about your line "Surprisingly to me at the time, dozens of users complained of things being randomly broken" you get any like user getting logged out from anywhere for the pages.
    – aibotnet
    Aug 26, 2016 at 11:09
0

I've just seen the same situation and determined that it's due to our traffic being directed through AWS CloudFront (other CDNs are available), so that's another scenario where you might see this behavior.

Time to rethink my sticky sessions to use something other than IP address. Cookie, anyone?

1
  • coudflare, cloudfront, some phone, tethering-based client, large VPN solutions, and especially Tor, .. there's a lot of stuff, that could explain clients changing IPs
    – SYN
    May 15, 2019 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .