实施无需注册的投票系统
我想在我的网站上实施投票系统，而不必强迫他们创建帐户。 他们最终会对具有唯一 ID 的内容进行投票赞成/反对。
- 我知道我可以将条目存储在带有 IP/ID 的表中，但如果有多个用户来自同一 IP，该怎么办？
- 有没有一种方法可以唯一地识别访问者而不与他们的外部 IP 绑定？
- 如果创建了 GUID，将其存储在该计算机上的 cookie 中，以后可以在同一台计算机上使用相同的 IP 检索它吗？ 不同的IP？
对这些问题的任何想法或对更好方法的任何见解都将不胜感激。
I'd like to implement a voting system on my site, without having to force them to create an account. They would ultimately be voting up/down a piece of content which has a unique ID.
- I know that I could store entries in a table with IP/ID, but what if there are more than one user coming from the same IP?
- Is there a way to uniquely identify visitors without it being tied to their external ip?
- If created a GUID, store it in a cookie on that machine, could it be retrieved later on that same computer with the same IP? A different IP?
Any thoughts on these questions, or any insight to a better approach would be greatly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（9）
是的，您可以使用 cookie 并将过期时间设置为很远的将来； 但是，没有什么可以阻止任何人清除缓存并再次投票。
您最好的选择是使用 cookie，并且不允许在 15 分钟内来自同一 IP 的投票...无需注册，这是您能做的最好的选择。
Yes, you could use a cookie and set the expiration very far into the future; however, there is nothing stopping anyone from clearing their cache and voting again.
Your best bet, is to use the cookie and don't allow votes from the same IP within 15 minutes of each other... without registration thats the best you can do.
您不仅可以根据 IP 来识别用户。 例如，您可以包含 IP + 整个请求标头信息（例如浏览器、版本号、功能）并对其进行哈希处理。 这或多或少会唯一地识别您的用户（不幸的是，不是 100%）。
You could identify users based on more than just their IP. For example you could include the IP + the entire request header information (such as Browser, Version Numbers, Capabilities) and hash that. That will more or less uniquely identify your user (not 100% though, unfortunately.)
您可以允许他们使用 OpenId 登录，这将允许他们使用现有帐户进行投票，而不必这样做创建一个新账户。
谷歌和雅虎以及其他公司都有允许您对用户进行身份验证的服务。
如果您不以某种方式对用户进行身份验证，投票系统就会容易被滥用。
You could allow them to login using OpenId, this would allow them to use an existing account to vote and they wouldnt have to create a new account.
Google and Yahoo and others have services to allow you to authenticate users.
If you dont authenticate users in some way, the voting system would me open to abuse.
原则上您不可能使用 cookie 来区分从未访问过的访问者和访问过但删除了 cookie 的访问者。 因此，任何基于 cookie 的解决方案都容易遭受微不足道的投票欺诈。
考虑本着 J Henry Lowengard 的精神接受这一现实，他在设置WFMU 上 100 强网站早在 20 世纪 90 年代中期，在“您的选票已计入”页面，标有“返回并投票更多！”
事实上，现在就去那里并投票支持（或反对）StackOverflow！
It is impossible in principle for you, using a cookie, to distinguish between a visitor who has never visited and a visitor who has visited but deleted the cookie. Consequently, any cookie-based solution will be vulnerable to trivial vote fraud.
Consider embracing this reality in the spirit of J Henry Lowengard, who, when he setup the top 100 site on WFMU back in the mid-1990s, provided a button on the "your vote has been counted" page labeled "Go Back and Vote Some More!"
In fact, go there now and vote for (or against) StackOverflow!
IP+用户代理比IP独特得多； 不确定它是否足以满足您的目的。 如果您向他们发送 cookie，只要 cookie 保留，该计算机就会返回该 cookie（如果他们使用相同的浏览器），无论 IP 为何，但请注意，用户可以随时删除 cookie 。
如果您完全担心使用该系统来防止投票欺诈，我不相信您无法绕过让他们拥有一个帐户。
The IP + user agent is a lot more unique than IP; not sure whether it's adequate for your purposes. If you send them a cookie, it will get returned by that computer (if they're using the same browser) as long as the cookie stays around, regardless of IP, but note that the user can get rid of the cookie whenever they want.
If you're concerned at all about using this system to prevent vote fraud, I do not believe you are not going to be able to get around making them have an account.
我现在也在想同样的问题。 我可能的方法如下：
(A) 您可以接受在您网站上（使用会话）至少 15 分钟（这可能是用户阅读某个网站中的一篇文章的大约时间）的人的投票。博客/网站）。 当他们投票时，计时器将重置以进行下一次投票。 这样，用户就不再需要删除 cookie。
(B) 您可以接受未注册人员的投票，获取他们的电子邮件地址并向他们发送投票验证链接。 当他们点击电子邮件中的验证链接时，您就可以实际计票了。 这就像按电子邮件地址投票一样。
(C) (A) 和 (B) 的组合。 这样您就可以确保每 15 分钟才向单个用户发送一次验证链接，这不会太多:)
I'm thinking the same problem right now. my possible approaches will be as follows:
(A) you can accept votes from those people who were in your site (using SESSIONS) for at least 15 minutes (it can be approximate time for a user to read an article in a blog/site). when they vote, the timer will reset for the next vote. so this way, there is no use deleting the cookies anymore for users.
(B) you can accept votes from unregistered people and taking their email address and sending them a verification link to their vote. when they click the verification link in their email box, then you can actually count the vote. it's like voting per email address.
(C) combination of (A) and (B). this way you can be sure you will be sending verification links only every 15 minutes to a single user which will not be a lot :)
您可以尝试 Evercookie 或类似的解决方案。
You could try Evercookie or similar solutions.
我知道这已经很旧了，但只是来到这里有了一个想法..
像 https://panopticlick.eff.org 这样的东西怎么样？ ？
还有一件事可以扔进去..
（如果它离线了：这是一个由通常的东西加上的累积指纹
+ 浏览器插件详细信息
+ 时区
+ 屏幕尺寸和颜色深度
+ 系统字体
+ 超级饼干
）
I know this is old, but just came here and had an idea..
What about something like https://panopticlick.eff.org ?
Yet another thing one could throw in ..
(If this ever goes offline: This is a cumulative fingerprint made of the usual stuff plus
+ Browser Plugin Details
+ Time Zone
+ Screen Size and Color Depth
+ System Fonts
+ supercookies
)
另一种选择是使用会话。 它允许您将会话 ID 与 IP 一起存储。 这将允许您从不同的会话获得多个 IP。 唯一的缺陷是可能会切换浏览器。 添加一块饼干使其成为三重奏可以帮助消除洪水。
我过去只使用 IP 地址完成了此操作，这似乎适用于小规模。
Another option would be to use the session. It would allow you to store the session id in conjunction with the IP. That would allow you to get multiple IP but from different sessions. The only flaw to that would be the possible switching of browsers. Adding a cookie to make it a trio could help weed out flooding.
I have done this in the past with just IP address, which seem to work on small scale.