Re: ASP authentification by ip-number

On Apr 26, 10:21 pm, Ralph Wiggum <go.ah...@xxxxxxx> wrote:
How safe is it to use the client's ip-number versus posting a username/password (in cleartext) in an http request? Assuming the client's ip-number is static.

A common use-case would be a web-forum, where only VIP-users should have access to specific topics. Authentification by ip is certainly the most user-friendly, as user don't have register/remember passwords, no?

Is ip-spoofing considered easier than picking up unencrypted usernames/passwords from web-traffic?

This way will not work when IP is not static, on a public computer, or
when client is behind a proxy. User-friendly authentication is
typically achieved by using the user’s cookies. Once the user has been
logged on, save the forms authentication ticket in the browser’s
cookies and set expiration, which is the date and time at which the
browser discards the cookie. When the forms authentication cookie
expires, the user can no longer be authenticated automatically. This
is what you usually get when the login form has a “Remember me”
checkbox.
.

Relevant Pages

  • Re: Newbie question-- Perl pw authentication without pop-up prompt
    ... forgive me if this is the worng group ... This newsgroup does not exist. ... content but want to hook in to the authentication phase. ... After all this is precisely why cookies exist. ...
    (comp.lang.perl)
  • Re: how to pass authorization to another application
    ... The host application will authenticate the user, ... Your browser will not send authentication information from one server to another. ... Cookies are the same way - the browser will not under normal conditions pass a cookie meant for one host on to another. ...
    (comp.lang.php)
  • [.NET 1.1] Authentication and cookies clarifications
    ... I'm testing ASP.NET 1.1 authentications and cookies features, and I've red tons of tutorials and articles about this, but not all is clear for me. ... My goal is to create a basic site with authentication process, like my other ASP 3.0 sites that I developed with classical session variables to follow each user with some personal data. ... In .NET 1.1 I understand the basic web.config settings with <authentication> node and and so on... ... I've tested the global.asax "onauthenticationrequest" to cast an identities to principal for use "isInRole" properties, but this hint not solve the problem of save in temporary memory some other data for not access to database everytime, also I want to use a database table for storing my users data, also their role in this application. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Accessing cookies returned in error responses with httpwebrequest (.net CF)
    ... authentication using the NetworkCredential class, ... The problem is that the site uses cookies to track the user attempting ... HttpWebResponse object to poach them from. ...
    (microsoft.public.dotnet.framework)
  • Accessing cookies returned in error responses with httpwebrequest (.net CF)
    ... authentication using the NetworkCredential class, ... The problem is that the site uses cookies to track the user attempting ... HttpWebResponse object to poach them from. ...
    (microsoft.public.dotnet.framework.compactframework)