HTML Multiplayer and Hiding Information

Question

I'm in the process of conceiving a multiplayer web-based game of sorts and was looking into different ways of achieving this. Instead of using PHP/MySQL/AJAX like I'm used to, a lot of sites are recommending the use of WebSockets of some kind.

My big question is, how do WebSocket games hide their information from potential hackers? It seems like anyone could hit "view source" on a page and find out everything they need to know due to it being written in Javascript, which to my knowledge is sent with the page. Is it possible to make a server desktop application that isn't hosted along with the website? If so, what languages have support for it?

Answer 1

I think you might have some misconceptions about how the application would be structured. You said a "server desktop application" but this a bit contradictory. Indeed, a server does not actually run on the desktop... at least not in the traditional sense.

Let's clear up a few things, then:

1. The users of your application can see your source code but if you design your application properly, this is not an issue. Even if this were a native desktop application, nothing would stop one from using an Assembly debugger and going about reading your code like that.
2. With this in mind, don't store information on the client. Phiilipp touched on this briefly, but I think it is important to "expand" more on this.

Traditionally, for web applications you will use some sort of server and split your logic. If you have confidence in JavaScript, then Node.js is a good choice and using something like Socket.IO. You mentioned you have experience with PHP, so why not PHP Websockets? Ratchet offers an implementation of that here: http://socketo.me/

With this, your important logic would still exist on the PHP server and then the less sensitive stuff on the JavaScript section.

Answer 2

Websockets always connect to a central server.

This allows to implement most of the game mechanics and store most of the gamestate on the server. The server only sends that information to the clients which they are supposed to show to the player and interprets any input from the client as a request which needs to be checked for validity and may be denied.

Designing your network protocol in a way which does not falsely assume that the client is trustworthy (it isn't - not in HTML5 and not in any other technology) does not just result in a much more cheat-proof game but usually also makes the game less bandwidth-intense (not sending updates about every object in the game and instead only for those the player can actually see means less information to transfer via network). This is an important concern for a web-based game, because you will end up paying for traffic.

Libraries which implement the Websocket protocol exist for many programming languages. When there is no such library for your preferred language but it supports raw TCP sockets, you can always create your own implementation from the specification (It's not the most easy to implement protocol, though).