4 deleted 483 characters in body
source | link

Everything on client side can be spoofed. So I guess the player can know the token sent through js at the end of the gameanswer is no.

So your unique chance to do that inEDIT I removed the right way is tosecurity mechanism I wrote here because it only assure the token your web sends to the score server before the game is sent by the server on server side (not on client side)legitime sessions. Then you must receive that initial token and store it on score server. This token is a secure token because there is not client side involved.

Then after the game ends, the client sends another token (which can be but spoofed) to the score server. Here you can do a check to match that client token to initial secure token sent and discard it if is not the same. So it scores can be done in a secure waysent through legitime sessions. Thanks @Luke Park

Everything on client side can be spoofed. So I guess the player can know the token sent through js at the end of the game.

So your unique chance to do that in the right way is to assure the token your web sends to the score server before the game is sent by the server on server side (not on client side). Then you must receive that initial token and store it on score server. This token is a secure token because there is not client side involved.

Then after the game ends, the client sends another token (which can be spoofed) to the score server. Here you can do a check to match that client token to initial secure token sent and discard it if is not the same. So it can be done in a secure way.

Everything on client side can be spoofed. So the answer is no.

EDIT I removed the security mechanism I wrote here because it only assure legitime sessions... but spoofed scores can be sent through legitime sessions. Thanks @Luke Park

3 added 55 characters in body
source | link

Everything on client side can be spoofed. So I guess the player can know the token sent through js at the end of the game.

So your unique chance to do that in the right way is to assure the token your web sends to the score server before the game is sent by the server on server side (not on client side). Then you must receive that initial token and store it on score server. This token is a secure token because there is not client side involved.

I guess you matchThen after the tokengame ends, the client sends afteranother token (which can be spoofed) to the game withscore server. Here you can do a check to match that client token to initial serversecure token sent and you discard everythingit if is not match, right? So the point is tosame. So it can be aware of server side initial random token is sent securelydone in a secure way.

Everything on client side can be spoofed. So I guess the player can know the token sent through js at the end of the game.

So your unique chance to do that in the right way is to assure the token your web sends to the score server before the game is sent by the server on server side (not on client side). Then you must receive that initial token and store it.

I guess you match the token the client sends after the game with that initial server token and you discard everything if not match, right? So the point is to be aware of server side initial random token is sent securely.

Everything on client side can be spoofed. So I guess the player can know the token sent through js at the end of the game.

So your unique chance to do that in the right way is to assure the token your web sends to the score server before the game is sent by the server on server side (not on client side). Then you must receive that initial token and store it on score server. This token is a secure token because there is not client side involved.

Then after the game ends, the client sends another token (which can be spoofed) to the score server. Here you can do a check to match that client token to initial secure token sent and discard it if is not the same. So it can be done in a secure way.

2 added 55 characters in body
source | link

Everything on client side can be spoofed. So I guess the player can know the token sent through js at the end of the game.

So your unique chance to do that in the right way is to assure the token your web sends to the score server before the game is sent by the server on server side (not on client side). Then you must receive that initial token and store it.

I guess you match the token the client sends after the game with that initial server token and you discard everything if not match, right? So the point is to be aware of server side initial random token is sent securely.

Everything on client side can be spoofed. So I guess the player can know the token sent through js at the end of the game.

So your unique chance to do that in the right way is to assure the token your web sends to the score server before the game is sent by the server on server side (not on client side).

I guess you match the token the client sends after the game with that initial server token and you discard everything if not match, right? So the point is to be aware of server side initial random token is sent securely.

Everything on client side can be spoofed. So I guess the player can know the token sent through js at the end of the game.

So your unique chance to do that in the right way is to assure the token your web sends to the score server before the game is sent by the server on server side (not on client side). Then you must receive that initial token and store it.

I guess you match the token the client sends after the game with that initial server token and you discard everything if not match, right? So the point is to be aware of server side initial random token is sent securely.

1
source | link