Http Server 可以检查两个不同的请求是否来自同一台机器
除了cookie/sessions（用户可以清除它们）之外，有没有一种方法可以允许HTTP服务器检查两个不同的请求是否来自同一端点机器。我在谷歌上搜索了很多，但很多人建议使用cookie，而其他人则说检查远程计算机的IP地址。问题是服务器无法获取端点机器的IP地址，它获取代理服务器的IP等等
PS：在我的场景中，所有用户的IP地址都不会改变..请帮我
更新 ：一次需要用户提供密码，CSRF 基本上保护了一笔交易的完整性——我需要一种解决方案，用户无需输入任何内容，并且服务器可以知道两个 >不同的HTTP请求来自相同还是不同的客户端计算机？
更新2：伙计们，我已经开始为有效的解决方案提供+300点的赏金——来吧，没有解决方案吗？算是一个挑战吧......
Is there a way except cookies/sessions(user can clear them) which allow HTTP server to check that two different requests are from same END-POINT MACHINE. I have googled a lot but a lot of them propose use of cookies, while others say that check the IP address of remote machine. The problem is that the server cannot get the IP address of END POINT MACHINE, It gets the IP of proxy server blah blah etc
PS: In my scenario, IP addresses of all users will not change.. Please help me out
UPDATE : one time passwords needs to be provided by the user, And CSRF protects the integrity of essentially one transaction -- Where as I need a solution where user does not have to enter anything, and Server can know whether two DIFFERENT HTTP REQUESTS are from same or different client machine?
UPDATE2 : Guys I have started the bounty +300 points for a valid solution -- Come on isn't there a solution? Be it a challenge....
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不知道 100% 准确的解决方案，但您应该看看以下内容：
http://panopticlick.eff他们
对浏览器指纹技术进行了非正式测试，并撰写了一篇论文，详细介绍了结果，该结果显示浏览器唯一识别的准确度约为 80%-90%。
您可能还想在 google 上搜索“evercookie”（由 MySpace“samy worm”名声大噪的 Samy 编写）来了解实施难以删除的 cookie 的技术。请注意，未经用户同意而对用户进行唯一识别可能会存在法律问题。
I am not aware of a 100% accurate solution, but you should take a look at the following:
http://panopticlick.eff.org/
They performed an informal test of browser-fingerprinting techniques and wrote a paper detailing the results which appear to be on the order of 80%-90% accuracy in unique identification of browsers.
You may also want to google "evercookie" (written by Samy of the MySpace "samy worm" fame) to learn about techniques for implementing hard-to-remove cookies. Be aware that there may be legal issues with uniquely identifying users without their consent.
拥有一个 google 一次性密码和 CSRF 预防。
Have a google for one time passwords and CSRF prevention.