I am developing a custom JS-based analytics software, so that I am able to track visits on certain websites.
The main fear I have are people who try to inject fake data into the system, so that visits projections aren't accurate.
However, it seems to be rather difficult (if not impossible) to accomplish this. One of the aproaches I've thought of was generating a unique, time-stamped, "authorisation string" (using a public key algorithm), that should be appended to the tracker URI. For instance, it would look like http://example.org/tracker.pl?ua=ff3&os=nt6&auth=secretcode
This solution is expensive though, in terms of CPU cycles, speed, bandwith, errors exposure, etc. And it wouldn't prevent the people I defined in the first paragraph from obtaining a string and using it.
What would you suggest?
