Bind cookie to IP address

[peoppenheimer]

The login page has a login option to bind cookie to IP address. If there's a help FAQ about this, please direct this bear of little brain to it. Otherwise, I'd be grateful for a bit more explanation.

Comments

[zdashamber]

I'm not sure if there's a FAQ about it, of if this answers your question, but in an effort to be helpful: I think the idea is that if you bind the cookie to the IP address, you will only remain logged in from the point of view of that internet connection. So if you go to a friend's house or the library, where you have a different IP address, then you will not be logged in.

[pne]

So if you go to a friend's house or the library, where you have a different IP address, then you will not be logged in.

Even if you use the same computer (e.g. you take your laptop along and use somebody else's wi-fi).

Depending on your internet connection, it might not even work from day to day; some Internet providers make you reconnect regularly (e.g. every 24 hours, at the latest) and give you a new IP address each time you reconnect.

The main idea, though, I think, is a security thing. If somebody steals a login cookie (by listening in on the wire - even easier if the "wire" is the air, if you're on wi-fi), they can basically log in as you. But if the cookie is tied to your IP address, they can't do that any more since their IP address will be different and the cookie they stole won't "work" for that connection.

[peoppenheimer]

Thanks to you both. Examination of the cookies reveals that none of them contains an IP address, unless it's encrypted. However, after having logged out of all sessions and deleted all cookies, I am no longer seeing the option of binding the cookie to the IP address, so I can't perform the experiment of creating new cookies to see whether they contain an IP address. In any case, both of your replies were helpful.

[azurelunatic]

It wouldn't have to be stored on your end: on Dreamwidth's end, it can just say "this login cookie should only be used by that IP address" and go from there.

[peoppenheimer]

Yes, indeed. Thank you.

[azurelunatic]

Unless they're also behind your router, of course.

[pne]

True; I hadn't been thinking of NAT situations.