Allow requiring a unique share link or password

EricKerby commented 3 years ago

Forms currently supports sharing to users who do not have an account using a public link. This functionality is critical. In some instances, though, a method is needed to prevent repeat submissions from the same person.

This could be accomplished by supporting generation of an arbitrary number of passcodes or unique ids to provide in the URL. For instance, 500 codes could be generated, exported from Forms, sent in mail-merge mailing, and thus be used to restrict entry to approved participants (and prevent duplicate form submissions).

Similarly, it could be useful to allow upload of a list of passcodes generated from a user/participant database.

skjnldsv commented 3 years ago

I think this is a bit over the top. Does any other forms app supports this feature?

ei8fdb commented 3 years ago

I think this is a bit over the top. Does any other forms app supports this feature?

The way most other Forms applications support this is by 1) restricting the same device by cookie, 2) restricting the same IP address from resubmitting responses (crude but effective in many cases), 3) requiring some form of login (usually login with email address - then subsequent responses are discarded)

My proposals

These are ranked in order of preference. I do understand some of these are more work to implement than others! 😄

Of all the above options, in order to minimise the issues for participants to fill out a form (by issues I mean: unnecessary request for email address, logging in, copying and pasting tokens) my suggested proposal would be:

1. Restriction by dropping a cookie to restrict repeated participation

This cookie would have an expiry date based on the closure date of the survey, or an abitrary length of time?

If the same participant tried to complete the survey again, they'd get a polite "survey is closed message", or "you've already completed this survey. thank you" message.

2. Forms creates unique sharing URLs for each email address the from creator wants to share the form with The form creator wants to share the form with 500 email addresses. They could copy and paste that long list into the sharing UI. Forms creates a unique URL for the form, and sends an email to each address.

This way the email address receives a unique URL.

This may be a lot of work to implement, and I think a bit difficult to handle in the UI. (Just a thought)

3. Restriction based on IP address If the Nextcloud server sees the same IP address more than once, it registers it as an address that's already submitted a response. Forms would need to track IP addresses of respondents.

The form creator would also need to mention the IP address is being gathered to allow this. (Maybe provide an automated way for that informtion to be displayed on the form?)

This approach might not work for situations where respondents are all coming from the same IP; a corporate network for example. I don't know how the IP detection works in these situations. Maybe it's better than I think!

4. Ask the participant to enter a unique token I would not propose asking the user to enter a token, or email address. There's more possiblilty of data entry error, or users being reluctant to provide email addresses without an explanation.