-1

I was ready to create an API, but I couldn't find a way to restrict users who weren't logged in.For users who have successfully logged in, I can fulfill this requirement. But for users who are not logged in, I hope he can use it 10 times for free.

The question is how to effectively control it?

  1. cookie?
  2. browser fingerprinting?
  3. ip?

I have thought about the above approach, but do not know how to achieve it completely.I have no experience with this part.

Amorous
  • 49
  • 6

1 Answers1

2

Identify a guest user by a combination between IP address and cookie, and record it to database with initialized visits to 0 

// guest user visiting recored
{ 
 ip : String, 
 cookie : String,
 visits : Number // default 0
}

every time unlogged user sends a request to the service, increase visits based on IP and Cookie founded in recored (database or cache), then judge based on visits number whether to deny or allow the service for a given IP and cookie

M. khalil
  • 36
  • 5