如何唯一标识具有相同外部IP地址的用户？

Question

I have created a service login module by python. I want to limit login. The login based on failed attempts per IP address might not work well and annoy the users connected to the Internet through a local network since they'll have same external IP address. Is there a way to uniquely identify such users? Thanks a lot!

Answer 1

I don't think there is a bulletproof solution, if the users are behind NAT. To differentiate those users you would need the private IP address, which you can not get on the IP level. If the users are behind NAT, you can only see the public/external IP which would be the same for all clients. You could try to get the private IP on the application level (client side), but that would be tricky (and also if the private address is obtained via DHCP, it can change between requests) The other solution I can think of is identifying users via cookies. So a HTTP response to each failed login request would contain a cookie which uniquely identifies that client. In that way you can differentiate users with the same IP. You would have to sign the cookie values to preserve their integrity. However, this does not help if the client deletes cookies after each failed request.