Question

• I am trying to build a voting system where user can vote without signing up on the site
• The cookies are dependent on browser, so people can vote more than once if they use different browsers(I want to stop them doing that)(I don’t want any bias)
• I read evercookie is something that I can use. The problem that I saw with this is that the call seems asynchronous. for example

I do the following

 var ec = new evercookie
 ec.get("id", function(value) { 
        alert("Cookie value is " + value);
        if (value != null) {
           alert('cookie already set, returning');
           return;
        }
        ec.set("id", "12345");
        alert('cookie saved');
 });

When I use this code, it first sets the cookie, refreshes the page and then returns the value, so I see in following order

cookie saved
cookie already set, returning

Can someone please help me to setup browser-independent cookies?

Thank you

Answer 1

You really should not use that library. It puts a lot of trash in your visitors browser, is very unstable (the page crashes for me). I think it exists to state a case and not to be used in a production environment.

Also, it can be worked around easily by just not using a browser, but a script (wget, etc.) instead. An attacker can vote hundrets of times in a short period like that.

You should save votes by IP-address in a database and allow only 1 vote per day or so. That’s the most common tradeoff between security and usability.