This question already has an answer here:
I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server.
Currently this is how the leaderboard is updated
Step 1) The user's score is stored in the offline app's local storage.
Step 2) The user presses the "update my score" button connecting to the internet.
Step 3) The button basically sends an ajax request to https://mywebsite.com/scoreupdate.php?userid=user_id&score=obtained_score
Step 4) Based on this the database is updated in my server by scoreupdate.php file and returns success.
These are the problems I am facing
1) Anyone can easily visit https://mywebsite.com/scoreupdate.php?userid=user_id&score=obtained_score if they know the user id (It can be easily obtained from the app's localstorage data) and he/she can update his/her score in the leaderboard simply by replacing obtained_score value with some high value to get a better position in leaderboard.
1) The app must be able to authenticate the scoreupdate.php file that it is the real app and not a person. So that only the app will be able to update the leaderboard.
2) The logic of the authentication shall not be cracked by the user just by reading the source code of the app. (eg: multiplying the user id with some numbers and doing the reverse process in server won't work)
Is there some way to accomplish this?
I am not worried if someone steals the user credentials via a MITM or any bruteforce like attacks. Even the real user who owns the profile should not be able to update his/her own score.