User Authentication Using Ip Address

[richiejones24]

I currently have a User Authentication Script, which when the user successfully logs in generates a cookie, which is there password encrypted using MD5  which is then verified on every page they visit against there password which works great. I am thinking of adding another level of security, when the user logs in there current ip address is recorded then on every page they visit as well as there password been verified there ip is compared against the ip they had when they logged in.

 

I know that if the user changes there IP they will be logged out, that is fine but is there any other problems which I have not foreseen? 

is there any reason i should not do this?

 

Thanks for the help 

[QuickOldCar]

Checking and saving against their ip on every page load seems wasteful to me.

 

Only reason I could see for saving their ip would be for banning purposes, which you could just ban them by username if that's the case.

 

And if wanted to ban ip's, should use htaccess instead.

[scootstah]

Storing passwords in cookies is a big no-no. Especially with MD5...

[AyKay47]

I currently have a User Authentication Script, which when the user successfully logs in generates a cookie, which is there password encrypted using MD5  which is then verified on every page they visit against there password which works great. I am thinking of adding another level of security, when the user logs in there current ip address is recorded then on every page they visit as well as there password been verified there ip is compared against the ip they had when they logged in.

 

I know that if the user changes there IP they will be logged out, that is fine but is there any other problems which I have not foreseen? 

is there any reason i should not do this?

 

Thanks for the help

 

two big issues here;

 

1. saving a users password with a cookie is a big security hazard since the cookie is frontend and therefore is available to users. I would suggest using a database to store user information and sensitive data.

 

2. as you have already stated, using someones ip to check authentication is not a good idea, people can easily change their ip address and sometimes do frequently which is a con that you cannot overlook.

 

why not simply have a login page where the user is required to type in there credentials, which are then compared to the data stored in the database, which grants them access to every page?