Databases
StackOverflow2013
Postsdbo
POStrategy for unique user-voting such as Stackoverflow's?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POStrategy for unique user-voting such as Stackoverflow's?
    primarykey
    data
    text
    <p>I noticed that for voting SO implements an XHR method which POSTs to a posts controller and sends the post ID and vote type through the URL, in addition a <code>fkey</code> parameter is sent, eg:</p> <pre><code>http://stackoverflow.com/posts/1/vote/2 </code></pre> <p>I'm going to be implementing a similar technique, I'm wondering what logic I could use to prevent duplicate voting by the same user and prevent spamming, in addition to overall logic when implementing this.</p> <p>The schema for the table I'll be storing them:</p> <pre><code>thread_id user_id vote_type 2334 1 2 </code></pre> <p>So far I came up with these bullet points:</p> <ul> <li>ensure the user is logged in</li> <li>ensure that a valid post ID and valid vote type is sent</li> <li>ensure that after POSTing, the user has not previously voted</li> <li>the code that creates the hash can't contain dynamic information such as user agent, since a user could be on a different browser, different OS, right?</li> </ul> <p><strong>Update:</strong></p> <p>"SO is probably using the login cookie to identify the user." - Andrew</p> <p>Could someone demonstrate how this would be done, or in other words more specifically provide an example of how the <code>fkey</code>, which is an alphanumeric 32-bit string, is generated?</p> <p><strong>Question:</strong></p> <ul> <li>since I'm not sending the actual user id anywhere with my XHR code, does this mean I have to update my table schema so that I can store the <code>fkey</code> instead of say, the <code>user_id</code>? The <code>fkey</code> will probably have to be unique to each user, and so I can probably query whether there is a row in the voting table that has an fkey of whatever.</li> </ul> <p>Would appreciate any tips or insight on anyone who's implemented a similar technique.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USmeder omuraliev
    1. USmeder omuraliev
    plurals
    1. This table or related slice is empty.
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POStrategy for unique user-voting such as Stackoverflow's?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POStrategy for unique user-voting such as Stackoverflow's?
      1. UStimpone
      1. VTFavorite
    3. VO
      singulars
      1. POStrategy for unique user-voting such as Stackoverflow's?
      1. USraaz
      1. VTFavorite
    1. COWhy are you not sending the actual user id anywhere with your XHR code?
      singulars
      1. POStrategy for unique user-voting such as Stackoverflow's?
      1. USMichael Myers
    2. COwell, I noticed that SO wasn't using it, and possibly for a good reason.. one could create a custom form, put a user id field with a value, and POST it and it would be a valid request, no? However, if you use something like the `fkey` chances are no one will be able to reverse-program it to get the same hash based on the user, which is why I think SO uses this method.
      singulars
      1. POStrategy for unique user-voting such as Stackoverflow's?
      1. USmeder omuraliev
    3. COSO is probably using the login cookie to identify the user. I checked with Firebug, and cookies are being sent.
      singulars
      1. POStrategy for unique user-voting such as Stackoverflow's?
      1. USJess
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload