HTTP: The Definitive Guide

Client IP Address

Early web pioneers tried using the IP address of the client as a form of identification. This scheme works if each user has a distinct IP address, if the IP address seldom (if ever) changes, and if the web server can determine the client IP address for each request. While the client IP address typically is not present in the HTTP headers,^[1] web servers can find the IP address of the other side of the TCP connection carrying the HTTP request.

For example, on Unix systems, the getpeername function call returns the client IP address of the sending machine:

status = getpeername(tcp_connection_socket,...);

Unfortunately, using the client IP address to identify the user has numerous weaknesses that limit its effectiveness as a user-identification technology:

• Client IP addresses describe only the computer being used, not the user. If multiple users share the same computer, they will be indistinguishable.

• Many Internet service providers dynamically assign IP addresses to users when they log in. Each time they log in, they get a different address, so web servers can’t assume that IP addresses will identify a user across login sessions.

• To enhance security and manage scarce addresses, many users browse the Internet through Network Address Translation (NAT) firewalls. These NAT devices obscure the IP addresses of the real clients behind the firewall, converting the actual client IP address into a single, shared firewall IP address (and different port numbers).

• HTTP proxies ...