Protecting/Handling game data

Question

I have been working on a web based game, in which involves a lot of javascript/PHP. My question is what is the most secure way to handle any data being passed between the two languages?

At this moment I am currently using javascript to preform any required functions such as making objects appear for you to click and then awarding points for clicking that object.

I know javascript isn't the best way to handle the data due to how accessible it is on the client-side. I currently use ajax to pass the points gained from a click, to PHP where it can then assess whether the points were gained fairly or by an exploit.

This works, however when it comes to making sure that the user doesn't abuse a function in the console such as "Spawning an object" I run into some issues, as I can't seem to think/find of a way to achieve this. At the moment I have it so when the game starts an interval begins which displays an object based on a random value and then when the user clicks that object it gets destroyed and their score is sent to a PHP file to check the action was legit.

Is there some sort of way I can make a checker in the PHP file to make sure that an object can only be spawned if the browser calls it and not the client. I know you can't stop a user from using the console, its more of thinking of a system to judge/evaluate whether an action is allowed by a user.

Answer 1

There are a few ways to secure your data depending on your needs. I'm listing the ones I've found the most use of over the years.

---

Javascript ( client side )

My suggestion is: Don't spend too much time on the client-side Javascript. Everything you do increases the time it takes to crack it and usually by not that much.

Do the basic stuff - minify your javascript and maybe obfuscate it ( UglifyJS2 does both and more - I do recommend using it ).

This will surely get rid of most of the people trying to hack - after all the majority are just programmers who might do it because it's fun but won't waste their time digging through obfuscated code for the purpose.

---

PHP ( Server side )

Here you can make magic happen. The rule of thumb is - if you want something to be reliable - do it yourself ( on the server, don't let the arbitrary clients handle it ). As your example with the points - this work rather well.

The main ways you can implement that are:

Server Only Logic

The server does what it does - the client posts a request and waits for the appropriate response.

Example: Final Action of Quest -> The Server finishes the quests and gives the reward -> The client displays the provided rewards to the user

Shared Game Logic

Both the client and the server do everything. The client mimics it to provide instant feedback for user actions, but anything happening on the server can override the client state.

Example: Movement. ( Usually the overriding of the state here is gradual and some minor differences are tolerated to improve the overall smoothness of the game )

Sanity Checks

The client executes the logic. The server has a pseudo algorithm to check if certain elements of the game behave 'normally'.

Example: Spawning objects can be a client-side operation, but acquiring points from them would be on the server. So the server would check whether or not the points acquired are from an unusually high amount of objects - after a certain threshold - they'll stop giving points or the points will be capped. You can also set up monitoring (plus notifications to you/admins) or even automatic bans for players that get a substantially higher amount of points.

Answer 2

Usually, obfuscating (minifying) the JavaScript code is enough to deter all but the most fervent of exploiters from abusing the script through the developer console. But without knowing how the PHP and JavaScript sides communicate, that might not be an option.

One idea does come to mind, however. You could have the server explicitly request the client to perform a specific job, and only care about the received result that relates to the requested task.

For example, your server determines it needs to spawn two objects. It tells the client to spawn two objects and keep track of what happens to them.

Now, the client might spawn more than the requested two by illegal means. It might even tell the server about all of the objects that have been spawned. But that doesn't matter - the server will only care about two objects and disregard the rest.

To summarise, have your server always make requests expecting a certain result. That way you'd deal with predictable data, and will be able to easily detect spoofing and other trickery from users looking to exploit the game.

Answer 3

If you want security, do the important jobs on the server. Nearly all operations that are being done on the client are easily accesible, editable and cheatable.

Note that, this may reduce the performance a bit depending on the connection speed of client.