Given a web application with authorized users, suppose there are users, like trolls, it's possible to lock one account, but the user can create another account and continue trolling.
Blocking IP not guaranteed defense, because a motivated troll can change their IP and access site again, but it more laborious work.
And banning the IP has also disadvantages, as other innocent users may lock access to login to the application, and this is why I am worried.
So, how reasonable is blocking IP address for web application? should I do it? What do you use for your web applications?