Sending high scores to a web server in an open source game

Question

I've never dealt with sending/receiving data from web servers in my games, so I absolutely have no idea how to do this. I tried googling for a good solution but couldn't find anything satisfying.

I currently get data from my web server by doing a HTTP request that gets the contents of a JSON text file stored on the server, and parses them in-game.

I do not know how to "write" high scores to the server, and even worse I do not know how to avoid people sending what they want to the server since the game is open source.

How is this usually done?

Answer 1

Here is several things you can do to validate score sent by player :

1. Before sending data to server, sign/encrypt it using a key (hidden in executable). Server will check if signature is valid.

   Note : this can be easily defeated by reverse engineering the game, but it is a lot harder to break than when sending plain text information without any encryption.

2. Every time player make an action that affect score (shooting a target) or change game state in a significant way (lose a life) record it somewhere (with a timestamp). When sending score, also send these events. Server will process the events and check if sent score appears to be possible (eg: by summing individual scores).

   Note : this can also be defeated because (after understanding how it works) user can create fake events.

3. Record every user input received by the game (mouse clicks + cursor position, keystrokes, ...). For each event, also record the frame number (aka tick) when event occured. Send all that information to server with score. Because sent information contain everything player have done and server have an exact copy of game, server will be able to replay the whole game from beginning to the end and then compare scores (score sent by player and simulated score).

   Note : this require server and client to have exactly same version of game, and your game to be predictable (no matter the framerate, or if random elements are involved in gameplay, ...). See When should I use a fixed or variable time step? for more info. This technique make it hard to fake big scores because only way to create these events is actually to "play" the game. This is, anyway, ineffective against bots.

Solutions proposed in 2) and 3) can be combined with 1).

Answer 2

Just do it. You can make a PHP (or whatever) server which accepts high scores and adds them to a database (text file, sqlite? Whatever).

If someone wants to cheat, they will. As the game is client-side in Javascript, they could simply modify the game code so they get 1000000 points for killing the first badguy, or whatever.

In my experience, people aren't likely to waste their time reverse engineering your protocol and submitting bogus scores. If they do, you'll probably spot them, right?

Answer 3

The simplest approach would be to send an HTTP request with the high score and other relevant data in a query string in the URL. Then you can handle it on the server with a script to whatever data method you like.

Since the game is open source there is no real way to obfuscate the method for sending the scores. You could try to employ some way on the server but in my experience if someone wants to crack it. They will. Fiddler and the source code would make it an exercise in futility. Good luck

Answer 4

it sounds like you are using HTTP GET to post the scores you would use HTTP POST