101 · Question #413
Identifying users by their IP address is a sufficient method of performing authentication and authorization.
The correct answer is B. False. IP address alone is insufficient for authentication because IPs can be shared via NAT, dynamically assigned, or spoofed, providing no reliable proof of user identity.
Question
Identifying users by their IP address is a sufficient method of performing authentication and authorization.
Options
- ATrue
- BFalse
How the community answered
(36 responses)- A8% (3)
- B92% (33)
Why each option
IP address alone is insufficient for authentication because IPs can be shared via NAT, dynamically assigned, or spoofed, providing no reliable proof of user identity.
Stating this is true would be incorrect because IP-based identification lacks the uniqueness, integrity, and non-repudiation properties required for proper authentication and authorization.
IP addresses are not a reliable authentication mechanism - many users can share a single IP through NAT or proxy servers, IPs can be spoofed at the network layer, and dynamic IP assignment means the same address may belong to different users over time, making it impossible to uniquely and securely identify an individual.
Concept tested: Limitations of IP-based user authentication
Source: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
Topics
Community Discussion
No community discussion yet for this question.