For fraud detection it seems great to include the IP address of the voter into the flag_content table.

I noticed that session_api kind of does this by tying from flag to sid to session_api.session_id to sessions.sessionid to sessions.hostname, but that only works as long as the session stays alive. If you need to research a session that got regenerated or has simply expired we no longer have that data.

Should we add long term storage of the IP address in flag module? Or perhaps to session_api?

Comments

ezra-g’s picture

ezra-g commented

Subscribe.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

As I read the session_api code more it seems like it wouldn't help us in the long run since it deletes sessions on cron.

I don't know the full purpose of session_api, so maybe it could be extended to keep sessions around for a bit longer.

quicksketch’s picture

quicksketch
he/him
commented

Should we add long term storage of the IP address in flag module? Or perhaps to session_api?

The entire point of depending on Session API was so that it could handle detecting IP addresses, cookie-based session creation and management. Therefor I'd prefer that Session API provide all such information storage and retrieval rather than Flag needing to store extra information.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Title: Include voter's IP address in flag_content » Maintain IP and session_api data for a long time (optionally?)
Project: Flag » Session API
Version: 6.x-2.x-dev » 6.x-1.x-dev
Component: Flag core » Code

Thanks, Nate. That works for me.

@jhedstrom, are you OK with a patch that keeps some more data (like IP) in the long run for archival purposes?

jhedstrom’s picture

jhedstrom
Primary language English
Location Portland, OR
commented

@greggles definitely :)

a.ross’s picture

a.ross commented
Issue summary: View changes
Status: Active » Closed (outdated)