Secure request from iPhone to Server

Question

I'm currently working on an app sending request on a server for a voting system. The problem is that people can vote without registration but I don't want them to vote multiple time and I don't know how to secure this. I thought about a key system (generated in the app and verified on the server), but I'm not sure that this is the best solution. What should I do ?

Answer 1

There are two possible solutions to this.

1) Handle the code that detects the duplicate vote on the server

For each vote cast the server stores the device id against the identifier of the vote. The server ignores any duplicate votes cast for that topic and sends back a "failure" response. This is handled by the device.

Pros: Centralized voting logic. Change it once on the server and all versions of apps in the wild conform.

Cons: You have to build the server logic. If you're more comfortable with ObjectiveC this may be an issue. You have to maintain the database of voting topics and devices that have voted.

2) Handle the code that detects the duplicate vote on the device

The device downloads a list of all the voting topics then filters them by the topics that have already been voted on. When a user votes on a topic then the device adds the id of that topic to the filter list.

Pros: No database maintenance beyond having a list of voting topics.

Cons: Users could remove the app, reinstall and vote again. If you want to change the voting logic (eg you want people to be able to vote twice on a topic) you have to update all the existing apps.

Admittedly putting the voting logic in the app makes the app more complex. However that added complexity has to be absorbed somewhere - either in the app or on the server.