I'm looking at Apache's
However, on this page it has the following disclaimer:
The information should not be trusted in any way except for rudimentary usage tracking.
Why not? What are the security trade-offs? What potential attacks exist? I have a specific use case in mind, but I need to be able to trust its output, and without any other information I can't see a way to understand what the issues might be.
Specifically: I'd like to use it for authentication. If I control the host which is using mod_ident, the host from which the connections are coming from, can ensure that no other host can connect, and control the network in between... can I trust it?