我将从简单到复杂给出我的想法。 在上述所有情况下，您可以创建会话，问题本质上转换为匹配会话与请求。

A)(困难:简单)使用客户端硬件显式存储某种类型的会话id/哈希(有相当多的隐私/安全问题，所以确保你哈希任何你存储的东西)，解决方案包括:

cookie存储 浏览器存储/webDB/(更奇特的浏览器解决方案) 有权限将东西存储在文件中的扩展名。

上面的问题是，如果用户不想的话，他可以清空他的缓存。

b)(难度中等)登录认证。 大多数现代web框架都提供了这样的解决方案，核心思想是让用户自愿地识别自己，这很简单，但在架构上增加了复杂性。

上述内容的复杂性增加，本质上是非公开内容。

c)(困难:困难-研发)基于元数据的识别，(浏览器ip/语言/浏览器/和其他隐私侵犯的东西，所以一定要让你的用户知道，否则你可能会被起诉) 非完美解决方案可能会变得更加复杂(用户以特定频率输入或使用特定模式的鼠标?你甚至可以应用ML解决方案)。 声称的解决方案

这是最强大的，因为用户甚至可以在没有明确要求的情况下识别他。这是对隐私的直接侵犯(参见GDPR)，并不完美。IP可以改变。

我觉得饼干可能就是你要找的东西;这是大多数网站唯一识别访问者的方式。

一个技巧:

Create 2 Registration Pages: First Registration Page: without any email or security check (just with username and password) Second Registration Page: with high security level (email verification request and security image and etc.) For customer satisfaction, and easy registration, default registration page should be the (First Registration Page) but in the (First Registration Page) there is a hidden restriction. It's IP Restriction. If an IP tried to register for second time, (for example less than 1 hour) instead of showing the block page. you can show the (Second Registration Page) automatically. in the (First Registration Page) you can set (for example: block 2 attempts from 1 ip for just 1 hour or 24 hours) and after (for example) 1 hour, you can open access from that ip automatically

请注意:(第一注册页)和(第二注册页)不应在分开的页面。你只写了一页。(例如:register.php)，并在第一PHP样式和第二PHP样式之间切换

通过HTTP连接只能获得少量信息。

IP - But as others have said, this is not fixed for many, if not most Internet users due to their ISP's dynamic allocation policies. Useragent String - Nearly all browsers send what kind of browser they are with every request. However, this can be set by the user in many browsers today. Collection of request fields - There are other fields sent with each request, such as supported encodings, etc. These, if used in the aggregate can help to ID a user's machine, but again are browser dependent and can be changed. Cookies - Setting a cookie is another way to identify a machine, or more specifically a browser on a machine, but as others have said, these can be deleted, or turned off by the users, and are only applicable on a browser, not a machine.

So, the correct response is that you cannot achieve what you would live via the HTTP over IP protocols alone. However, using a combination of cookies, as well as IP, and the fields in the HTTP request, you have a good chance at guessing, sort of, what machine it is. Users tend to use only one browser, and often from one machine, so this may be fairly relieable, but this will vary depending on the audience...techies are more likely to mess with this stuff, and use more machines/browsers. Additionally, this could even be coupled with some attempt to geo-locate the IP, and use that data as well. But in any case, there is no solution that will be correct all of the time.

假设您不希望用户拥有控制权，那么您就不能这样做。网络并不是这样工作的，你能期望的最好的是一些启发式。

如果你可以强迫访问者安装一些软件并使用TCPA，你可能会成功。

如果没有用户的合作，识别访问网站的电脑是不可能的。但是，如果他们允许，您可以存储一个cookie，以便在机器再次访问您的网站时识别它。关键在于，访问者是可控的;他们可以删除cookie，并随时以新访客的身份出现。