IP 地址身份验证对于 Web 服务/网站安全吗？
我们正在构建一个用户可以订阅的 Web 服务，并且我们正在考虑根据用户的 IP 地址对用户进行身份验证。
我知道这会带来一些麻烦，例如，如果客户端的 IP 发生变化，但我想从安全角度知道这是否安全？我不确定欺骗 IP 地址有多难，但我的想法是，即使发生这种情况，我们最终也不会将数据发送回攻击者。
有什么想法吗？
谢谢！
We're building a web service which users will subscribe to, and we were thinking of authenticating users based on their IP address.
I understand that this creates some hassle, eg, if a client's IP changes, but I wanted to know from a security point of view if this was safe? I'm not sure how hard it is to spoof IP addresses, but my thinking is that even if that happened we wouldn't end up sending data back to the attacker.
Any thoughts?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我想说这会非常危险。黑客使用多种 IP 欺骗工具来逃避检测，并且存在合法的匿名用途。通过 Tor 网络查看 IP 洋葱（例如，维基解密人员广泛使用）http://www.torproject.org
也就是说，如果您的数据根本不敏感，就像您想猜测他们的位置以显示当地天气一样，您当然可以使用 IP 块来粗略地定位人员。如果您想要的就是这种东西，请查看：http://www.hostip。信息/dl/index.html
I'd say this would be very risky. Hackers use a number of IP spoofing tools to avoid detection, and there are legitimate anonymity uses. Check out IP onions via the Tor network (used extensively by wikileaks folks, for example) http://www.torproject.org
That said, if your data isn't sensitive AT ALL, like you want to guess their location to show the local weather, you can certainly use IP blocks to roughly locate people. If that kind of thing is all you're after, check out: http://www.hostip.info/dl/index.html
考虑一下代理和 VPN。
如果用户想从其他电脑使用您的网站怎么办？
您可能想要使用浏览器指纹（与 IP 一起），这样更安全，但是他们必须始终使用相同的浏览器...
结论：不是一个好主意。
Think about proxies and VPN's.
And what if an user would like to use your site from an other PC?
You might want to use browser fingerprints (together with IP) it's safer, but then they must always use the same browser...
Conclusion: not a good idea.