Re: ASP authentification by ip-number

Most of my users are behind their company's firewall. If I keep a database of firewall ip-numbers and check incoming requests against the database, wouldn't that be an ok solution?

Steve Riley [MSFT] wrote:
Wrong approach. IP addresses identify machines, not humans. They are easily spoofable, since they are always clear-text and are always unauthenticated. Plus, with your approach, authorized users will be tied to specific machines--they won't be able to access their information from other computers.

User ID/password pairs are specifically designed for the scenario you've described. Please use them.

.