[QGIS-Developer] Rating abuse issue on the QGIS Plugins Website

[Laurențiu Nicola]

Hi Lova,

Requiring users to log in seems fine to me, but you can use the X-Forwarded-For or CF-Connecting-IP headers to find out the real IP of the client.

Laurentiu

On Wed, Aug 19, 2026, at 10:07, Lova Andriarimalala via QGIS-Developer wrote:
> Hello everyone,
> 
> Following the plugin rating abuse issue reported at  https://github.com/qgis/QGIS-Plugins-Website/issues/416 and https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder if someone could help or share some thoughts about it.
> 
> We have released some fixes to enforce throttles (https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject forged cookies and add a cap votes per address (https://github.com/qgis/QGIS-Plugins-Website/pull/423). However, it is not fully working because every IP recorded against a vote is a Cloudflare edge IP, not a real user IP. I checked 100 recent votes against Cloudflare's published ranges: 100 out of 100 match. So the per-IP cap is counting Cloudflare's proxy pool, which rotates per request. So, storing real client IPs would probably require some discussions regarding GDPR and retention angle.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260819/06e9d514/attachment-0001.htm>