Interesting issue, never thought about xid being used in that way before!
Rather than store the user ID, can you store a bcrypt hash of it?
What’s the attack vector you are addressing? I guess access is given to the database for outside auditing?
I’m just thinking if the db or app server is compromised anyway then someone could install a trigger to log the table changes, or change the app logic to log the vote somewhere else, etc.
Rather than store the user ID, can you store a bcrypt hash of it?
What’s the attack vector you are addressing? I guess access is given to the database for outside auditing?
I’m just thinking if the db or app server is compromised anyway then someone could install a trigger to log the table changes, or change the app logic to log the vote somewhere else, etc.