# Some light security on a voting web site

**URL:** <https://www.ruby-forum.com/t/some-light-security-on-a-voting-web-site/164389>\
**Category:** Rails\
**Created:** [March 31, 2009, 8:04pm UTC](https://www.ruby-forum.com/t/some-light-security-on-a-voting-web-site/164389 "2009-03-31T20:04:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![andy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/aeb1de/32.png) [@andy](https://www.ruby-forum.com/u/andy)\
**Post date:** [March 31, 2009, 8:04pm UTC](https://www.ruby-forum.com/t/some-light-security-on-a-voting-web-site/164389/1 "2009-03-31T20:04:20Z")

</div>

I’m creating a site where a profile can be voted on by guest users.

I want to prevent basic fraud by disallowing multiple votes for the  
same profile in one session.

I was thinking about using a session array and checking for the  
profile ID in the session array.

So far, it’s not working correctly and I’m not even sure if this is  
the best approach.

Any ideas?

I’m open to new ideas, or at least debugging on my code:

```
unless session[:voted_user_ids]
  session[:voted_user_ids] = Array.new
end

```

unless session[:voted\_user\_ids].include? params[:voted\_user\_id]  
@vote = Vote.create(…)  
session[:voted\_user\_ids].push params[:vosted\_user\_id]  
end

Thanks,  
Andy

---

<div class="post-metadata">

**Author:** ![andy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/aeb1de/32.png) [@andy](https://www.ruby-forum.com/u/andy)\
**Post date:** [April 1, 2009, 1:52am UTC](https://www.ruby-forum.com/t/some-light-security-on-a-voting-web-site/164389/2 "2009-04-01T01:52:27Z")

</div>

You could take a look at [http://blog.peteonrails.com/vote-fu/](http://blog.peteonrails.com/vote-fu/)

---

<div class="post-metadata">

**Author:** ![andy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/aeb1de/32.png) [@andy](https://www.ruby-forum.com/u/andy)\
**Post date:** [March 31, 2009, 8:16pm UTC](https://www.ruby-forum.com/t/some-light-security-on-a-voting-web-site/164389/3 "2009-03-31T20:16:38Z")

</div>

On Mar 31, 2009, at 11:03 AM, Andy wrote:

> the best approach.  
> @vote = Vote.create(…)  
> session[:voted\_user\_ids].push params[:vosted\_user\_id]  
> end

If that’s your exact code, it’s not working cause you have  
“vosted\_user\_id” (see that extra ‘s’) in one of your lines…

Also you can replace your first three lines with:

session[:voted\_user\_ids] ||= []

-philip