php限制网站使用基于会话ID和/或IP地址和帐户代理切换器

Question

I really don't think there is a fool-proof method for this but of course I'm coming here for advice...

I have a project that I want to restrict to 3 uses per day per user based on IP address. Of course I can do this easily with a mysql table for traditional use cases...but how would I account for those clever enough to use something like foxyproxy (a proxy switcher plugin for firefox) and/or open a new browser to get a new session. Every use would appear as a fresh, unique user.

Am I stuck to a non-fool-proof method or is there anything else I can try? I am pretty certain that most of our user base will not have a clue how to use or even what these methods are but I want to account for it anyway.

EDIT: If there is a non-php solution to this as well, I am open to any ideas.

Answer 1

There is literally nothing you can do to prevent this in a fool-proof way. No matter what you come up with, working around it will be trivial for anyone with a vague clue about how the web works.

You should implement a proper authentication system and limit based on the user ID instead of the host accessing the service.