CODEWITHSUNDEEP
securityauthorization
el_pup_le
el_pup_le

Reputation: 12179

Voting system hack proof

I'm implementing a voting system like Stackoverflow's. How can I implement this so it is hack proof?

I've got some PHP that does database work according to the ajax request sent after the javascript parses it. Would doing a query to check the current vote state of a user be enough to avoid unauthorised votes?

Upvotes: 1

Views: 823

Answers (2)

CAFxX
CAFxX

Reputation: 30301

NOTE: THIS IS AN ANSWER TO THE ORIGINAL QUESTION
Don't downvote it just because the OP radically changed his question.

It's a huge error even just thinking of relying on browser-side components to enforce application logic. Javascript should be used, in untrusted environments, exclusively for presentation purposes.

All application logic should be implemented, validated and enforced server-side.

Upvotes: 0

Sergio Tulentsev
Sergio Tulentsev

Reputation: 230336

It is definitely possible to implement pretty reliable solution. But this must be done server-side.

Basic rule of security: you don't trust client data.

Move all your checks to PHP and make your javascript as dumb as 

$(".vote").click(function(e) {
    $.post('/vote.php', vote_data, function(result) {
        // update UI according to returned result
    }
}

It's a common thing, however, to still do checks on the client, but as a way to improve usability (mark required form fields that weren't filled) or reduce server load (by not sending obviously incomplete data). These client checks are for user's comfort, not for your security.

Answering to your updated question:

If you store full log of when which user voted for which question, then yes, it's pretty easy to prevent multiple voting (when user can vote for the same thing several times). Assuming, of course, that anonymous votes are not allowed.

But if you have a popular site, this log can get pretty big and be a problem. Some systems try to get away by disabling voting on old articles (and removing corresponding log entries).

What if someone intentionally tries to hack me?

There are different types of attacks a malicious user can perform.

CSRF (cross-site request forgery)

The article lists some methods for preventing the attack. Modern Ruby on Rails has built-in protection, enabled by default. Don't know how it is in PHP world.

Clickjacking

This attack tricks users into clicking on something what isn't what they think. For example, they may click "Play video", but the site will intercept this click and post on user's wall instead.

There are some articles on the Web as well.

Upvotes: 7

Related Questions