Has anybody encountered the situation when the same user from the same session ID and the same browser requested 2 different scripts on the same webserver inside the duration of 30 sec from two different IP addresses thorugh HTTPS?

Is it viable/normal situation?

2 Answers 2


Yes, it's normal. ISPs, particularly AOL and mobile providers, can route traffic through different proxies which will change the IP address of a user as they surf the web. Users using a proxy server can also experience this. This is why depending on a static IP address from a user during a session is not recommended for any kind of identification system on a website.

  • +1 @John Conde, thanks. I just want to make sure if your answer covers HTTPS and not HTTP only? Commented Feb 11, 2011 at 13:25
  • 2
    https only encrypts the connection. It doesn't affect the IP address.
    – John Conde
    Commented Feb 11, 2011 at 14:03

There may also be a case of session hijacking in which case the users session is hijacked by a cracker and used to access the legitimate user's account. In this case we may find the user to be "virtually" accessing the web content from two different IPs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.