Hourly limit exceeded when multiple users log in from same IP address

Question

My company has set up a kiosk where our 250+ users can come log into their Facebook and approve our app. We are having them all run through the login process at the same time. All our traffic is going through one IP address.

After the first hour, we noticed the users were getting the "Your account has been locked..." and had to verify their account by selecting photos of their friends. Sometimes they wouldn't even be able to do that as the option was greyed out and said "Hourly limit exceeded" in parenthesis. We wouldn't get this every time, it was very random.

We are using the JavaScript Facebook SDK to make calls to the Graph Api.

What would cause this? Is there any way for companies to disable this feature to have the login process go smoother? What can we do to avoid this?

Answer 1

I don't know if you can disable that. I can see why it would happen though. If I ran a site like facebook and 250+ user accounts logged in and went to the same app all under the same IP it would be fairly suspicious. To the point that I probably wouldn't want it to be able to be disabled. This would appear as an attempt at some form of attack/hack, as innocent as it is in real life. But, having the ability to block it would open up for vulnerabilities. Keep in mind that Facebook is doing that for a reason.