> Markdown version of [/events/world-congress-2025/sessions/660-ip-authentication-a](https://www.wearedevelopers.com/events/world-congress-2025/sessions/660-ip-authentication-a). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# IP Authentication: A Tale of Performance Pitfalls and Challenges in Prod


- **Date:** Thursday, Jul 10, 2025
- **Time:** 16:10–16:40 (30 min)
- **Room:** Stage 1
- **Event:** World Congress 2025
- **Tags:** performance

## Recording

[Watch recording](https://www.wearedevelopers.com/videos/1413-ip-authentication-a-tale-of-performance-pitfalls-and-challenges-in-prod)

## Description

I explore our journey with IP-based authentication as part of a major re-engineering of our authentication methods. I will focus on the inherent performance challenges and unexpected issues we encountered... in production. I will talk about why IP authentication, despite its initial appeal, is a problematic solution in practice.

- The fundamental flaw
- Performance implications of constant IP checks
- Production rollout tale: Massive error rates (>30k/hour)
- Root cause analysis: Unexpected impact of cookieless crawlers
- Lessons learned

I will offer insights for engineers considering IP authentication (don't do it). I will discuss how the requirement for constant IP checking creates a performance bottleneck, and how seemingly minor factors like crawler behavior and old clients can significantly impact system stability. I will also talk about our production fuckups and how we tried to find out if our customers really had a problem or if this was just a storm in the waterglas. 

## Speaker

### [Christoph Eicke](https://www.wearedevelopers.com/@christoph-eicke)

Christoph Eicke, Engineering Manager at Statista


## Related talks at this congress

- [Lessons learned from observing a billion API requests](https://www.wearedevelopers.com/events/world-congress-2025/sessions/845-lessons-learned-from) — Pratim Bhosale
- [Keycloak case study: Making users happy with service level indicators and observability](https://www.wearedevelopers.com/events/world-congress-2025/sessions/665-keycloak-case-study) — Alexander Schwartz
- [Delegating the chores of authenticating users to Keycloak](https://www.wearedevelopers.com/events/world-congress-2025/sessions/861-delegating-the) — Alexander Schwartz
- [The AI Agent Path to Prod: Building for Reliability](https://www.wearedevelopers.com/events/world-congress-2025/sessions/621-the-ai-agent-path-to) — Max Tkacz