I am currently building an multiplayer application game on Android, and the server-side logic is deployed using Cloud Functions, which is a server-less environment. The application logic is as follows: two users are given a question (i.e. the same one) and they both try to answer it. When one user answers the question, we check whether their answer is correct or not in server-side. This is where I am confused. Suppose that the user's answer is incorrect. The server will come to this conclusion and send back data to the client-side to notify the user that their answer is incorrect. Suppose that the client-code is as follows:
boolean is_correct_answer = getServerResponse();
In our example, the
getServerResponse() will return false in this case (i.e. since the user's answer was incorrect). From what I understand, the client-side code can be manipulated, and so the value of
is_correct_answer can be set to true by some hacker. Therefore, the server side validation wasn't useful at all in our example. My question, then, is: what is the proper way of validating user's answers and subsequently notifying them whether their answer was correct or not?