Im using the nginx module HttpSecureLinkModule to protect resources from being hotlinked with expiring hashes which use user's IP address to make a hash that will only work for them, on top of expiring after x seconds. The issue I noticed, is that a very small percentage of users, very frequently, get bad hashes, which results in nginx rejecting the hash and sending the user to an error page that says the hash is expired or malformed.
The servers that generate the hashes and accept them and returns resources are different, times are in sync. People would report issues to me, I would try it myself on multiple PCs, browsers, IPs, and I never had issues.
The only thing that I can think of is that their IP address changes when they hit www.domain.com (which generates the hash) and then hit subdomain.domain.com/file.ext?hash= to get the actual file. Different IP address would cause it to return an error.
Is such a thing possible under certain ISPs? If so, any way to get around it, other than not using IP addresses in the hashes?