I intend to have a Javascript/HTML5 game with a global leaderboard. I have devised a very simple system for submitting highscores as follow:

When the game finishes, the game client makes a POST request to server hosting the leaderboard that contains the name of the player and their score. Then, the server inserts the submission into its database.

However, this system can easily be cheated by an individual with an html form submitting POST requests with whatever score they want to my server.

I already know that a foolproof anti-cheat system is impossible because of how easy it is to modify Javascript and HTML on the client. I also know that I should never trust the client. However, implementing everything on the server side will be impractical for me since my server will not have the resources necessary to perform all the calculations for all the players.

So instead, I simply wish to make it as hard as possible for the average individual to cheat (and recognizing that it will always be possible to cheat), while making it as easy as possible for me to identify when a score that was submitted might possibly be fake.

What are strategies I can use to accomplish such? Please include examples whenever possible. For example, I have heard someone suggest using "pre-shared keys". However, I am not a cryptography expert and I have no idea how to go about implementing that.

  • 5
    \$\begingroup\$ There's already info regarding cheating in HTML5 games: gamedev.stackexchange.com/questions/37392/… \$\endgroup\$ Dec 29 '15 at 21:27
  • \$\begingroup\$ @SamuelRochaGarcía I have read that question that you linked. It does give me some ideas for making it harder to cheat. Although I really would like to see an example as to how one might custom-build your JS for each player. Additionally, I am also interested in strategies that make it easier to identify possible cheaters after already receiving the score submission. Are there any resources on that? \$\endgroup\$ Dec 29 '15 at 21:37
  • \$\begingroup\$ It is possible, if you have the right tools, to change data that uses JS, so therefore you have to add another way the data is stored so if one is changed the other one isnt and you can then identify the cheater. As of making it harder to cheat this is a double one as you can get the JS data to be compared to the other way you saved \$\endgroup\$
    – user69046
    Jan 1 '16 at 13:31