Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Has anybody encountered the situation when the same user from the same session ID and the same browser requested 2 different scripts on the same webserver inside the duration of 30 sec from two different IP addresses thorugh HTTPS?

Is it viable/normal situation?

share|improve this question

2 Answers 2

up vote 10 down vote accepted

Yes, it's normal. ISPs, particularly AOL and mobile providers, can route traffic through different proxies which will change the IP address of a user as they surf the web. Users using a proxy server can also experience this. This is why depending on a static IP address from a user during a session is not recommended for any kind of identification system on a website.

share|improve this answer
    
+1 @John Conde, thanks. I just want to make sure if your answer covers HTTPS and not HTTP only? –  Gennady Vanin Геннадий Ванин Feb 11 '11 at 13:25
1  
https only encrypts the connection. It doesn't affect the IP address. –  John Conde Feb 11 '11 at 14:03

There may also be a case of session hijacking in which case the users session is hijacked by a cracker and used to access the legitimate user's account. In this case we may find the user to be "virtually" accessing the web content from two different IPs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.