Game Development Stack Exchange is a question and answer site for professional and independent game developers. It only takes a minute to sign up.
Sign up to join this community
I have created a couple of games in Flash/AS3 and am playing with programming a flash-based multiplayer (possibly mmo?) game where the application will communicate with a server over a socket connection.
Obviously I need some form of authentication (username and password) but what other security precautions do I need to explore to prevent cheating?
a big one for flash dev is to never compile any secret into the source, because a decompiler can pull it out pretty easily. so any authentication that you need to do should be session based, and not hard coded into the game.
other than that it's pretty much the same as web site security, use a session, only send a passphrase over https, etc.
Your main priority should be assuming the client talking to your server isn't your flash code, but a program written specifically to try and break the server. Fuzzing is a common technique to try and find this sort of issue.
There's also the possibility of a client that instead of trying to break the server it will try to let a real player cheat or automate gameplay completely. This is significantly more complicated to detect and prevent.
Verify all user input on the server and make sure that it is legal. There are a lot of similar questions if you just search on here for cheating.
