Some servers do authentication based on client IP address — does caching break this type of authentication scheme?
Unfortunately, some web services use client IP addresses for security (authentication) purposes. These schemes are not particularly secure. Malicious client machines can use IP spoofing to impersonate valid clients. Furthermore, unless the contents of client/server HTTP conversations are encrypted, anyone with physical access to any part of the network between client and server can eavesdrop on the traffic. Web caching in general creates problems with this kind of security scheme: the servers see requests from the IP address of cache devices, not from IP addresses of clients. Noticing that a client has requested a page from an “invalid” IP address, the server is misled into thinking that a malicious client is trying to request another client’s content. However, the CacheQube can work with this kind of security scheme. The CacheQube admin can add IP filtering rules that force the CacheQube software not to redirect certain servers’ HTTP traffic. Such traffic will thusly flow directly bet
Related Questions
- Some servers do authentication based on client IP address -- does caching break this type of authentication scheme?
- What is the WEP authentication type for the base station and a client with Base Station Client Utility (BSCU)?
- Does it break out medical costs based on type of treatment, or just the cost?
