Dylan Found a Vulnerability on a Web Application That Let

Multiple Choice

Dylan found a vulnerability on a web application that let him copy the sessionID out of a local cookie and place it into another cookie, therefore assuming the identity of the original user. The problem is that the server also associates the originating IP address. Dylan simply spoofs that address but he then finds he cannot establish an interactive session with the server. Why?

A) The attack should work as stated.
B) There is a NAT firewall preventing this activity
C) Dylan cannot spoof his address over HTTP
D) The server will send all replies back to the spoofed IP.