Let’s say I have a page where a user has an option to like a dislike something. The like or dislike actions send a post message to a control which increments/decrements the number of likes on a object. However, the user is not logged in when they do this action.
How can I protect this page from javascript code that automatically clicks on like or dislike. Right now, after the user clicks one of them, that entire container becomes hidden, but couldnt someone use javascript (in the url/bookmarklet) to bring it back and then execute a click?
Security problems include CSRF, Clickjacking and the Coup d’état for this poorly planed feature is that ip addresses are basically free. So if anyone wants to upvote, they can and they can do so as much as they want. If you want to slow them down you need a captcha to protect it.