Home/ Questions/Q 8545011
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-11T12:41:32+00:00

Relatively new rails programmer here, so bear with me. I have an app where

  • 0

Relatively new rails programmer here, so bear with me.

I have an app where registered users can create polls but anyone can answer the polls.

I am using Devise for my authentication. I want non-authenticated users to be able to answer the polls but I want to prevent double-voting.

I assume this should be done with persistent (not session) cookies, but I’m not sure. So when the user enters the site, I create a user in devise and I store some random value in both the User model and in the cookie, and I check that the user has not answered the question previously when he/she attempts to load my “answer” page?

Can someone give me some advice on whether this is the right approach and/or point me towards a resource to help me get started?

I have found relatively little information out there on how to manage persistent cookies in Rails.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can’t reliably prevent people from voting multiple times without logging in. It’s not possible. I guess people could also create multiple user accounts to vote so there is no fool proof way.
    Cookies are often cleared automatically by certain popular cleaners and unless you are only going to allow people to vote on a product they have purchased I think you are kind fighting a lost battle.

    Stack Overflow limits voting capability by making sure a certain level has been achieved before being allowed to vote but I guess that’s not really applicable to your scenario.

    This is not so much about sessions and cookies and more about setting up your database to record a vote including the voter id.

    In the view that allows users to vote I would suggest that you switch between a voted icon and a vote now link depending on whether or not the currently logged in user has voted.

    To determine if the user has voted then include the user id of the currently logged in user in a question_vote xref table.

    For the belt and braces approach to prevent abuse of the html in the browser add the check to the validations of the question_vote record.

    I would do this by adding a can_vote? method to the user model that accepts a question id as a parameter then you can use the question_id plus the user id to find a matching record in the question_vote table if a reordx is found return false otherwise return true

    • 0