Hi Lova, Requiring users to log in seems fine to me, but you can use the X-Forwarded-For or CF-Connecting-IP headers to find out the real IP of the client.
Laurentiu On Wed, Aug 19, 2026, at 10:07, Lova Andriarimalala via QGIS-Developer wrote: > Hello everyone, > > Following the plugin rating abuse issue reported at > https://github.com/qgis/QGIS-Plugins-Website/issues/416 and > https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder if someone > could help or share some thoughts about it. > > We have released some fixes to enforce throttles > (https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject forged > cookies and add a cap votes per address > (https://github.com/qgis/QGIS-Plugins-Website/pull/423). However, it is not > fully working because every IP recorded against a vote is a Cloudflare edge > IP, not a real user IP. I checked 100 recent votes against Cloudflare's > published ranges: 100 out of 100 match. So the per-IP cap is counting > Cloudflare's proxy pool, which rotates per request. So, storing real client > IPs would probably require some discussions regarding GDPR and retention > angle.
_______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
