Path: csiph.com!eternal-september.org!feeder.eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail From: Ben Bacarisse Newsgroups: comp.lang.javascript Subject: Re: Voting on a site Date: Wed, 21 Nov 2018 11:50:39 +0000 Organization: A noiseless patient Spider Lines: 44 Message-ID: <87r2fed4z4.fsf@bsb.me.uk> References: <01f72933-e7af-4b36-b561-4061694191e3@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: reader01.eternal-september.org; posting-host="54137f4f1bd58961f89227006ff320d7"; logging-data="15875"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/IE3uuGf8mWwlihDDIMNQ1ZsSwtqn8s+w=" Cancel-Lock: sha1:jfcX/7JrILdvRkAo5hUCuXx+rZU= sha1:17luVsAeKTG+hUa7E4I0Uw1q/a0= X-BSB-Auth: 1.bbe63202ee289807e143.20181121115039GMT.87r2fed4z4.fsf@bsb.me.uk Xref: csiph.com comp.lang.javascript:35844 groovee@cyberdude.com writes: > I'd like to have some buttons on my site for "voting", eg. say there > are emoticons on a post saying "angry", "happy", "sad" - users can > click one. This is not going to be a client-side scripting issue so you'll need to move the question elsewhere to get the best answers. > Now what I'd like to prevent is users repeatedly clicking a button to > increase the no. of votes for that button (or even worse, a script > doing it!). Fundamentally, you can't because nothing in this sort of interaction knows what a person is. I click "happy" and pass the laptop to my friend in the cafe and she clicks "happy". You can't tell if that was me again or not. And there's nothing to stop me loading the page in every machine in a lab full of PCs and clicking "happy" on them all. The point is that you need to decide how seriously to take this and then pick what notion of "user" identity you can live with. Most sites that take this seriously will use logins. That does not uniquely identify a person, of course, but it might do. The trouble is you put off casual users. I just walk away from 95% of sites that want me to register. I just can't be bothered in most cases, but maybe your content and services will be so compelling you can force people to register in order to use some parts, like the voting. > I'm a little confused as to how to architect this...? Do I > set a client-side cookie when the button is clicked, say, to expire in > 5 mins or whatever; or do I have to set up Apache (SOMEhow!) to > prevent repeated votes coming in from the same IP or something like > that? (I REALLY don't like this idea - it's highly likely that there > could be 2 people who have the same IP within a small time frame - > it's a small geographical location I'm targeting the site at, and I > plan for the site to be VERY POPULAR!! :) ) Those two cancel each other out so you are probably not talking about a lot of users. That's good, because you need to store the votes on the server. There's really no other reliable way. -- Ben.