I have an idea to implement a account system using email and passwords for games. Im intending to have the account creation and forget password systems on a webpage. So if users will have to access the webpage in order to access those features. The users will login with those details in the game.

For the account creation and forget password, I'm thinking of setting in my webpage server. While the account database will be stored with the game server which will also host the account's scripts.

Im think that if i were to put my game server script path in the HTML form, the user will be able to know the location of my game server. Thus, for user who wish to hack my server will know the location. With that i was thinking, if the form points to a script in my web server, and that script will sent the data to my game server script. Does that mean the game server will only be comprise if my web server is hacked?

Regarding to the user's email and password, I know that storing the password in plain text is not a good way. The recommended way was to encrypt it with a hash and salt. Im wondering if the encryption and salting should take place at the client side (HTML) or the server side(script at game server)?

If it happens at the game server, i will have to send the password in plain text, ain't it? OR i could hash the password with MD5 or SHA-1 or SHA-256(etc..) at the client side and receive the hashed password at the server side and perform a second round of hashing with salting on the game server?

The things i'm looking for in this question is about how secure for both my users and my server for this method of authentication.

migrated from serverfault.com Jun 14 '14 at 2:13

This question came from our site for system and network administrators.


The state of the art is as follows:

  • Registration page is posted back to the same server, which contacts and updates whatever authentication database you want.
  • Passwords are hashed either on the webserver or the authentication server (if the auth server is more than just a database). Use bcrypt or scrypt for the hashing.
  • The account creation & password reset pages should be served over SSL.

Keep in mind that none of this hides the location of your game server to the users if the game server is contacted directly by the game, as users can then find the game server from the connection from the game client.


I suppose you would have a cluster of servers rather than a single server to support your game on the server side. Given that to be the case, you would give the Cluster name or IP address for the form on the client side. If you can implement strong enough security at your router / cluster level, crackers will not be able to get into individual servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy