Re: Problem with cookies in poll script

From: J.O. Aho (user_at_example.net)
Date: 11/09/03 

Date: Sun, 09 Nov 2003 00:13:03 +0100

Mike Trozzo wrote:

> My problem is this: When the script checks that someone with that IP
> address has voted in the current month, or if the cookie exists (which
> expires at the end of the month), it's supposed to bring up a screen saying
> that you're only allowed one vote per month. When the IP/month combination
> has a match, everything happens as it should. However, even when the valid
> cookie is there, it calculates a vote. I tested it by taking out the code
> that checks IP/month, and it keeps going through as if there is no cookie.
>
> Can anyone point me to the error of my ways? Also, what are good ways to
> further tighten things up so that a visitor can't:
> 1. vote
> 2. delete the cookie
> 3. disconnect/reconnect to the ISP generating a new IP
> 4. vote again?

In this kind of scripts, I always make the check first, before setting any
variables and if the user is trying multiple votes, redirect them to another page.

Your datecheck function (you should have made it to a function) is quite
resource demanding, as you load all the rows from the database (if you have
the database on another machine than the webserver, then you will see how slow
your code is), do a query where you ask for all entries with the voters ip and
a date that is in this month, this way the number of rows that is returned is
hopefully at most one.

To save resources, if the cookie is found and it's saying that the vote is
done this month+year, then don't check for the ip in hte database, as the user
has done his/her vote already.

Only if the user don't have the cookie, make the search, only in hte case you
think that the user shouldn't be allowed to vote (of course this would cause
problems for dynamic ip users).

  //Aho

Relevant Pages

  • Re: E-mail Voting Security Q
    ... > voters affecting 10% to 15% of the vote. ... favour of us email voting with NO security in place. ... I am thinking the webpage voting with cookie should be adequate. ...
    (comp.security.misc)
  • Re: Problem with cookies in poll script
    ... >> cookie is there, it calculates a vote. ... > the database on another machine than the webserver, ... if the cookie is found and it's saying that the vote is ...
    (alt.php)
  • Problem with cookies in poll script
    ... When the script checks that someone with that IP ... that you're only allowed one vote per month. ... cookie is there, it calculates a vote. ... that checks IP/month, and it keeps going through as if there is no cookie. ...
    (alt.php)
  • Re: E-mail Voting Security Q
    ... >> Personal identities of voters are unproven ... > A voting system must identify the voters, ... rather obvious fact that some people will vote swing. ... quickly have the same cookie on both machines... ...
    (comp.security.misc)
  • Re: cookies
    ... >> i have created a pool and the problem is that anyone can vote until ... >> create a cookie, or it can't read the cookie) ... > rather than simply recording a vote response I advise that you record ...
    (alt.php)