This is not language specific. What are the best methods to limit how many times a person may submit a web form, not knowing any info about that person. Example: Voting for the all star game online, only allowed 1 per 24 hour cycle. Something where you don’t have to “log in”. My thoughts were:
- Use Captcha to keep bots at bay
- Drop a cookie that expires in 24 hours
- Check IP address if no cookie present (How many people are going to get banned because of NAT using this technique)
- Anything I’m missing?
Very good technique is to use Flash cookie. Many people clears cookies or uses different browsers. Flash cookies are cross-browser: they have same value across all browsers in your system, and people often doesn’t know they exist.
How it works you can check here:
http://www.nuff-respec.com/technology/cross-browser-cookies-with-flash
Cookie and IP are of course also worth checking, but cookies don’t block cheating, and IP blocks NAT users.