Question

I have an application where any request on a page must be inserted to a count table , however how can i check if the requesting is a real user not some tool made by a user to make 1 million request in a second or something like this in asp.net ?
note : I cannot put a captcha or something like this on this because the user is not entering any data

Answer 1

If a cookie is out of the question then i would suggest time tracking on the server. I would assume you have some way of tracking the user, wehther it be cookie based or by authentication (they logged in to your site). (Without tracking the user it would be pointless counting requests).

This means that for each request from each user, you track two things:

• the user ID
• the time when they requested the page

When they make the request, you increment the counter. If they make another request, you check the timestamp for the previous request – if it is too soon you don’t count the current request. This mechanism can be very easily modified to count requests only once every x seconds, or even to only count 1 request per day, etc. If you settle on a timespan that would represent continual requests from a normal user, you can skip counting any requests that happen before that timespan has elapsed. Alternatively you could also log those suspect requests. If you are sending data of some sort back with each request, you can send nothing back for the suspect ones.