This is slightly off topic for the question, but this line got me thinking.
"If a client attempts to run the application with an unknown or expired session id, the client ip is placed a penalty box for a timeout (no login allowed during the timeout)."
A good example of a harmless visit to the penalty box is the user who is using the app and goes off to lunch. He returns to his browser and tries to use the app, sending his ip to the box because of an expired session. He refreshes or hits the back button, sending him to the box for 8 more seconds or maybe more depending on how many times he tries to use it. Why not just send the expired users straight to the login screen with no penalty at first (maybe a zero second penalty) and then see what they do? Just a suggestion.
-----------------------------------
Washizu
Odd Man In: Guns and Game Theory
In reply to Re: Identifying clients
by Washizu
in thread Identifying clients
by ruzam
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |