How do I protect sending scores from HTML5 games to my server

Question

On backend I am using java. I have a game in HTML5; when user completes it I sends an Ajax call to save the score to database. Now, someone can easily use tools like Fiddler and firebug to modify this ajax request and send a much better score to the server. How do I make sure that user cannot manipulate scores !

Answer 1

Don't just send an integer score to the server. Send a collection of game stats that can be used to verify the score was realistic. Or you can implement some pre-shared key for calculating the score. You could send incremental scores and stats throughout the game and ensure that the increase is reasonable.

However, I wouldn't worry too much about it. The suggestions above will make it more difficult, but not impossible to send a fake score. However, if you just make it slightly difficult a vast majority of people that play your game will not be interested in trying to cheat it.

Do be careful about how you're allowing your game to communicate with your server. You don't want your game to be an entry point into your server for hacking. Make sure you always validate your input and never trust the client.

Answer 2

As Byte56 said: "never trust the client", but:

Never trusting the client comes at a price:
Having all games being played on the server will increase your infrastructure cost a lot.

Assuming most of the players won't cheat
and the top highscore will settle after a little time and stop changing a lot

there is a middle way.

Record the games (on the client).
(Depending on the game type that might be super easy (e.g. chess) or a little complicated (e.g. a multiplayer FPS),
but it's always doable.)

When a player finishes a game just submit the score.
If the score is within a certain range at the top (e.g. top 1% or top 5)
request the recorded data from the player
and replay that game on the server.
If the scores match, accept the score.

This way you don't need any additional server side resources for most of the plays,
but can ensure the top scores are valid.

Answer 3

Reduce social motivation to cheat by e.g. using social leaderboards (cheating only makes you look good to a handful of friends, it doesn't spoil it for everyone).

Verify on server. Joel Poloney had a good write-up of techniques in Game Developer 2012 September "Scale Your Online Game"

Answer 4

Do not worry about it; protecting from all attacks is essentially impossible if you trust the client. If nobody uses Fiddler etc, to modify the AJAX request, they can simply fire up a JS debugger and modify your game data to give themselves 1000 lives, etc, or modify your code, or do 100 other things you haven't thought of.

I wrote such a game several years ago, and to the best of my knowledge, nobody cheated in this way. There was no prize, except having your name on the score table.

Answer 5

When you want to create a cheat-proof online game, you need to handle all game logic on the server. Everything that happens on the client-side can be controlled and manipulated by the user. There are techniques like encryption or obfuscation you can try, but in the end it's all just security through obscurity which can be circumvented by someone who is sufficiently determined.

Sure, a game which runs on the server is a lot more complicated to develop, requires a lot more resources server-sided and network latency is detrimental to the game experience (especially for fast-paced games), but it's the only way to effectively prevent the players from cheating.