I'm building a poker like game server, I was going to have all logins and game logic to be handled on one server, but from my research on the web, I learn that this would not scale, and it would make sense to split the work into a login and game servers. But what I don't get is after I handled authentication in the login server, and have the client make a new connection to the game server, how would I know which client is which? Would I not have to re-login again and thus defeat the purpose of having a server for login? Is there some way to pass a connection across processes and machines that I don't know about? Excuse my little knowledge of networking.
Although Philipp's answer is perfectly good, there is a slightly different way that does not require a connection between the login server and the game server, which is useful if such a connection is difficult.
This works because:
Or to put it more simply, the hash ensures that it's nearly impossible for the sender to have forged their login token and so the information in the token can be trusted.
As with any security oriented hashing, use the best hash function you can get - at the moment people seem to like bcrypt, PBKDF2, and scrypt - and ensure your secret key is very long so as to make brute force reproduction less practical.
|show 7 more comments|
Note that in order for this to be secure, the tokens need to be created from a cryptographically secure random number generator, each token may only be accepted once by the gameserver and unused tokens should be discarded after a few minutes.
|show 2 more comments|