Take the 2-minute tour ×

We're working on a new opensource tool that enabled users to vote. No login is required for this.

Now here's the challenge: how can we ensure the API is only called once per day from a specific machine without requiring the user to login?

We think this can be easily spoofed, but perhaps there are solutions that we haven't thought about.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

There isn't a full proof solution if you're not going to require users to register on your site/app. Since you're not requiring them to register/login, then you're limited to two options: Unique votes by IP or by cookie.

IP Address

Easy to implement by storing the IP address of the vote in a data store then referencing that the next time a vote comes in from the same IP. However, many ISPs such as AOL could use the same IP address (via proxy) for multiple users. As a result you'll be preventing those who haven't cast a vote to be able to vote.


This approach will be more client specific, meaning once they vote from that machine they won't be able to vote again. However, this is even less robust since the user can delete the cookie and vote again (or open a different browser on the same machine that doesn't have the cookie).

In short, if you can't force the user to register and establish uniqueness in your system, you could rely on either solution above but they won't be robust and will come with their own limitations.

share|improve this answer
I think we'll go with ip rate limiter. It can be spoofed, but it's not critical. We were already 100% sure that this is impossible without login, but you never know if smarter people walk this earth. –  René de Kat Nov 13 '12 at 21:45

Your Answer


