PHP locked ip address

Question

I lock the ip address.

Does this mean than user can only login in with the same ip address? Or will the user logout and have to re-login to get a new session?

if (isset($_SESSION['last_ip']) === false) {     $_SESSION['last_ip'] = $_SERVER['REMOTE_ADDR'];  }  if ($_SESSION['last_ip'] != $_SERVER['REMOTE_ADDR']){     session_unset();     session_destroy();   } 

Answer 1

This code will delete the session (logout) if the user's IP address changes.

So the user can log in from any IP address, but will be logged out if it changes.

This could work to prevent session hijacking, but it wont work very well if you're on a dynamic IP because your IP will keep changing.

Answer 2

It does. If the user's IP changes, he'll be logged out. Although an attacker could still mimic the IP if he knows it, so it's not totally secure. Take a look at these pages for more information on how to prevent session hijacking:

• What is the best way to prevent session hijacking?
  
• Proper session hijacking prevention in PHP
  
• PHP Session Fixation / Hijacking
  
• Stopping session hijacking

I'd also highly recommend Chris Shiflett. His article on session hijacking can be found here:

http://shiflett.org/articles/session-hijacking