I am looking to build a very loose authentication system that can track a user and link submitted data/comments to a specific user. The submissions are essentially anonymous, but a user may want to edit his submission/comment at a later date.

I want the experience to be as smooth as possible so do not want to ask users to sign up for an account and then login each time. There is no point as their submissions are not in their name and to another user browsing the site, there is no way of linking a submission to a specific user (think anonymous comments on a blog post or pastie). However, the user should have the ability to edit (at least in the short term) the content they have posted.

The way I imagine doing this would be to place a unique identifier in a cookie on the users machine. This would enable me to link a submission to a user, and while that cookie remained on the users machine, I would allow them to edit their content. Of course, if the cookie is lost, or the user accesses the site from a different browser, then they would not be able to edit their content, but this is not really an issue, they can always resubmit a new piece of content.

Is there a better way of doing this? How can I implement this so that the user can edit their data for the longest possible amount of time.

  • Use a cookie (as you suggested) or some other type of session identifier.
    – Bernard
    Apr 14, 2012 at 0:59

5 Answers 5


If you want the longest and most flexible, implement OpenID and require them to register. Done correctly, it's little more than a couple of mouse clicks. Check out how easy it is to join one of the stack exchange sites.

If that's too much work for you/your users, then a cookie is really the only good choice -- you could generate a unique query string and have them bookmark it, but if they won't register with OpenId, they probably won't want to keep track of a URL.


An interesting approach might be to allow the users to create a password for each entry. No username/profile/registration - just along with the post - a password. The password should probably have some strict guidelines to keep your site from getting bruteforced into wall to wall spam. I'd probably make it timeout after a reasonable amount of time too (only you can decide what "reasonable" is). That would get you around the cookie expiration or not-on-same-computer issues.


You may want to look a SQRL. This is a rather new login mechanism which provides exactly what you look for: An anonymous, repeatable login for a user, using a stable (per server) user ID.

You may want to associate a user name, password, Address etc.., to this user ID but this is all optional.

SQRL is under active development by security expert Steve Gibson at grc.com.


Get your users to enter a name and email address before creating the cookie. Associate their email address to that cookie's identifier in your database. Provide limited access to your website.

If the user decides to register, then have them fill out a form. If they use the same email address as the one in the cookie then associate all content associated with that cookie to their newly created account. So now they can always edit it.


Easy way? Grab their IP address. It's not perfect (what if several people are behind the same router, what if their IP address changes, what if they posted from work/starbucks/their phone, etc) but all you need to do is log the $_SERVER['REMOTE_ADDR'] of each user who posts...then only enable editing if they are from that IP address.


if($_SERVER['REMOTE_ADDR'] == $comment_author_ip_address_in_database){
    <stuff here for editing the comment/post>
  • 7
    Wow, that's...NO. Don't do that. The number of large sites that use NAT firewalls is very large. That means that a big company with thousands of machines may only have a handfull of externally visible IPs. If you try to go by IP, then any number of people would appear (to the site) to be the same user. Bad idea. Apr 14, 2012 at 1:54
  • 1
    I agree with Michael Kohne and also want to add another point: many users change IP address. Too many get a different IP address at home every 24 hours or less; in the same way, mobile devices may change IP addresses when moving from a zone to another. Apr 14, 2012 at 4:52
  • 2
    I remember using a clustered caching proxy a few years ago which meant that requests to websites from one machine in one session — indeed, within minutes of each other — would still come from multiple IP addresses, even before considering things like shifting between networks. This behavior was sustained for months. (We scratched that service in the end because it caused so many problems and cost more to maintain than the reduction in external bandwidth charges saved…) Apr 14, 2012 at 7:19
  • Yeah, and I said all of that in my original post. Any "login-less" authentication system will have issues, at least until we can grab the MAC address of a chip embedded in the end user's brain...and even then, you might have to deal with MAC address spoofing. It's not perfect, I said that. You probably also want to disable editing after a certain period of time. All that being said...easier for you, the website admin, would be OpenID, as suggested above.
    – jakimfett
    Apr 24, 2012 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.