3

We are currently making WebGL games for an online portal that then rewards users points they get from In Game Score. The Score is sent to the WebServer in the form of POST service, Recently we have had cases where user Tamper with the score somehow. Any Idea on how to secure something like this? What are the standard Industry Practices for something like this. How Can we validate the scores on the Server? Any Help would be greatly appreciated.

1
  • 2
    This sounds like you need to figure out how to validate a user's score within your own games. Even using TLS one could spoof a POST message to your server.
    – RoraΖ
    Oct 13, 2015 at 11:25

2 Answers 2

3

What are the standard Industry Practices for something like this. How Can we validate the scores on the Server?

It depends how tech-savvy your users are. A trivial way for them to tamper the data is to use a (intercepting) proxy to intercept outgoing traffic and tamper the Score value (TLS cannot prevent this).

One of the industry practices to prevent tampering and verify the authenticity of the requests is to use JWT. JWT is widely used for authentications management of REST APIs, however, it could also help to solve your problem. JWT signs all the requests and any modification of the data in transit would invalidate it on the server.

Remember, as I mentioned above it depends how technical your users are. Using JWT only stops tampering of the requests when they depart from your application. With a rare likelihood, a user can still directly access to the memory and modify something (e.g., change a game functionality, overwrite an attribute etc).

2

Best practice: ALWAYS TREAT ALL USER SENT INFORMATION AS FALSE UNTIL PROVEN RIGHT

How to do that:

  • encrypt the score, and some other identifiable field through a one way algorithm and send them.
  • then on the other end, verify the salt.
  • To make the salt even more... obscure, concatenate them in a reproduceable way. Remove the algorithm, and cost(if you always know them) and concatenate them. Then split on the character index, reappend the cost and algorithm, and then verify. If this gets generated in the game then it will be a monumental task to break in and find the information.

Of course this might have some issues(what happens if they can create their own bcrypt scores and such and figure out how to concatenate it correctly) in which case the easy fix is to change the cost, and how it gets concatenated(in fact this can be automated to happen every day or such). Simple. Easy. Done.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .