store and retrieve cookie values in C#

I have a slot machine application which displays a flash file using c#. Any user would come to the site and play the game. But I would need to limit that a max of 3 times per day, meaning he could play the game only 3 times and if he goes to play the fourth time, then he would get a message indicating he could play the next day. Since there is no user login on this site, i have decided to store cookie values. It would be counter that would increment each time he gets into the site. Then, on each page_load event, retrieve the cookie value and if its 3, then display the No Play Message.

First i would retrieve the value of cookie on page load event.

string _counter = response.Cookies["slotmachinecookie"]["counter"];
    if (!IsPostBack)
    {
    if (_counter) = 3
       //displayMessage
       return;
    else
    {
       HttpCookie cookie = new HttpCookie("slotmachinecookie");
       if (string.IsNullOrEmpty(_counter))
         cookie.Values.Add("1", "counter");
       else if (_counter == "1")
         cookie.Values.Add("2", "counte开发者_如何学Cr")
       else if (_counter == "2")
         cookie.Values.Add("3", "counter");
    }
}

Will this work? I guess i could try it but just want to make sure if there is a better way other than cookies to do this? Thanks in advance.

---

Based on my comment, your approach will work, but a savvy user could outwit your usage limitation by clearing cookies and continue playing all day long.

While the cookie approach is easy, it does have a hole in it.

What you may want to consider is capturing the user's incoming IP address and storing it in a database, or local cache (depending on how your application is architected), or some other repository.

You can capture the incoming IP address by using the server request variable REMOTE_ADDR.

Request.ServerVariables["REMOTE_ADDR"]

Again, based on how your app is hosted, your provider may not report this correctly (e.g. if your server is behind a load balancer, which may be the IP of the load balancer). You may also want to check if your provider forwards this information using a "X_FORWARDED_FOR" header. (Some devices use different variations on the name of this header...check your documentation.)

So this will be a little more complex, but also will be able to close that hole a bit more to limit usage to only 3 times a day.

I hope this helps. Good luck!

---

I didn't see where you are checking the date and resetting the count to zero if it's a new day.

And, is it per day or per 24 hour period?