IP Authentication: A Tale of Performance Pitfalls and Challenges in Prod

I had the pleasure of presenting this talk twice in 2025 - first at the WeAreDevelopers World Congress in Berlin (July 10th) and then at code.talks in Hamburg (November 6th). In this talk, I explore our journey with IP-based authentication as part of a major re-engineering of our authentication methods, focusing on the inherent performance challenges and unexpected issues we encountered… in production.

What this talk covers

• The fundamental flaw of IP authentication
• Performance implications of constant IP checks
• Production rollout tale: Massive error rates (30k/hour)
• Root cause analysis: Unexpected impact of cookieless crawlers
• Lessons learned

I offer insights for engineers considering IP authentication (spoiler: don’t do it). I discuss how the requirement for constant IP checking creates a performance bottleneck, and how seemingly minor factors like crawler behavior and old clients can significantly impact system stability. I also talk about our production fuckups and how we tried to find out if our customers really had a problem or if this was just a storm in a waterglass.

WeAreDevelopers World Congress 2025 - Berlin

code.talks 2025 - Hamburg

If you have any questions or would like to discuss the topics covered in this talk, feel free to reach out to me on LinkedIn.