Comments on: PHP Web Services – Authentication Based on Client’s IP

By: Mangal

Mangal — Thu, 01 Dec 2011 06:50:51 +0000

Thank you, Dimuthu,

I am using PEAR::SOAP in our application that’s why can’t use your “authentication by username token”. if you have any other idea to secure PEAR::SOAP web-service then please update me. it will help me lot.

Thank you

By: dimuthu

dimuthu — Thu, 01 Dec 2011 06:14:35 +0000

Hi,
Sure. If apache access control is used, you can avoid IP spoofing attacks. If you are using WSF/PHP you can use username token, that would do authentication in application level with more control. See here, http://www.dimuthu.org/blog/2008/09/23/authenticate-using-username-token-from-php-2-minutes-introduction/

By: Mangal

Mangal — Wed, 30 Nov 2011 14:05:35 +0000

Hi Dimuthu,

Thanks for writing the article.

Dimuthu, as Nabeel says that IP based authentication can be spoofed what happen if we restrict the access of our webservice by apache access control also. Is this add some more security?

Please suggest, i am waiting your reply.

Thanks.

By: nik

nik — Mon, 08 Feb 2010 16:33:16 +0000

hi Dimuthu You have done good job for Ip based authentication.
But here I have done using username password based authentication.
You can check it from this link.

http://my-source-codes.blogspot.com/2010/02/php-nusoap-web-services-and.html

Thanks.

By: dimuthu

dimuthu — Sun, 28 Dec 2008 01:58:29 +0000

Hi Nabeel, Thanks for the note. I think I got what you are pointing out. Server possibly determine the source IP from the header of the IP packet, which can be easily regenerated with a fake source IP by some attacker. Here I was answering to the problem asked in the forum http://wso2.org/forum/thread/4609, http://wso2.org/forum/thread/4659. I will mention your note in there too. Thanks Dimuthu

By: Nabeel

Nabeel — Sat, 27 Dec 2008 23:57:16 +0000

This comment is not directly related what you are pointing out in this entry. However, it may serve as a precautionary measure. In the absent of filtering at routers/firewalls, this method is vulnerable to IP spoofing attacks. Therefore, in such situations IP based authentication should not be used as a replacement to other authentication methods, such as WS-Sec username-token, but rather as a complement if the operation being protected is very sensitive.