Getting Different IP each time

Question

Hello,

I am creating a poll script for a facebook fan page:

http://www.facebook.com/apps/application.php?id=115400635147687&v=app_115400635147687

I am getting the IP using:

$_SERVER['REMOTE_ADDR']

But the problem is that each time I refresh the page, or make an ajax call, the IP is changed everytime. Someone told me that facebook has many IPs, proxies.

Basically I need to save the IP in database, so that once a user from certain IP has voted, he should not be able to do so again.

What is the solution or alternative to this??

Answer 1

Blocking by IP is not really a reliable way of doing things (need to consider about people sharing the same public IP). Since it is a Facebook application, can't you instead block by the logged on Facebook account instead?

Answer 2

I assume the IP at the top of the linked page is what you're dealing with. If we do a whois:

$ whois 69.63.181.250

OrgName:    Facebook, Inc.
OrgID:      THEFA-3
Address:    1601 S. California Ave
City:       Palo Alto
StateProv:  CA
PostalCode: 94304
Country:    US

NetRange:   69.63.176.0 - 69.63.191.255
CIDR:       69.63.176.0/20

We find that those IPs belong to Facebook's servers, not to your users.

If I understand what's happening correctly, when someone requests a page from your application, Facebook's servers request it from you on their behalf. In that case, you simply won't be able to get your users' IPs.

Answer 3

Note that when developing a fan page in Facebook, the Facebook servers essentially act as a proxy. That is, the user's browser asks Facebook for the page, then Facebook's servers make a request to your website to get the content. The Facebook server then rewrites all links and Javascript so that it any callbacks go through the Facebook servers first.

In the end, that means that you'll never see the user's "actual" IP address on your server: you'll only ever see Facebook's IP addresses.

This is done for privacy reasons, as I understand it. That is, the user will have to explicitly allow your application to access their profile before you will be able to get any "identifiable" information about them.

Answer 4

I found the perfect solution finally. Basically when you do ajax post, you can get the user's id using:

$_POST['fb_sig_user']

Thanks to all of you for your answers. Have a good day/night ahead :)