Success checks for client-side javascript mini-game embedded within a server-side browser game

Question

Disclaimer: I know that client-side is always to be held with suspicion, but I'm trying to conceive of a way to verify the success or failure of javascript-based mini-games.

Mini-games to add fun to client-side game

Here is an example scenario:

I implement a javascript-dependent picture-sliding game for various pictures.
You know the type:

So that would be a javascript game that would be served from my website.

How to check success

I then want to set up a verification scheme to verify that the game has been completed, the browser would ping the website with a verification code or scheme to say "hey, I'm done, and the javascript mini-game is complete".

There are two ways that I can think of to make the verification work.

1. One is a "replay" scheme, e.g. each of the moves that the user does would be concatenated and sent to the server, which would have a system for verifying that the end result was indeed a valid solved state.

2. The other is a "summary" verification code, for example if each of the numbers is assigned a random letter client-side, the final sliding puzzle state would result in a word-code like asdfaseasewadsfwef when read from left to right, top to bottom, which can be sent to the server upon completion to receive a pass/fail grade of success. Obviously that isn't checking the intermediary steps, just the final result, but it'd probably be a lot faster and less resource-intensive, and would probably prevent a bit more abuse than just a GET request with a "go" parameter.

I don't have a huge, high bar for 100% secure communication in this case because I just want to add fun, and give some minor/non-overwhelming benefits from the mini-games, not build a fort-knox system. And if someone is smart enough to hack up a solution to the mini-games to automate them, I won't be excessively broken up about it.

Techniques?

So with that in mind, are these two approaches valid? Are there other approaches to try with this? Any examples in the wild that I could learn from?

Answer 1

new answer

(I thought of a better approach than what I wrote in the first place, but I'm leaving the original answer for reference)

Instead of having the client tell the server when the puzzle is completed, do it the other way around (ie. the server tells the client when the puzzle is completed). That way the client simply tells the server what move was made every time the player makes a move, and then the server can tell the client when the puzzle is complete in the response to the request from the client.

This way you get the security of option 1 without the bother of writing code to playback a series of moves.

---

old answer

Personally I would go with option 2 because you don't need this to be 100% secure. That is definitely a lot easier.

However, are you sure you don't care about cheating? Whether or not cheating on the mini-game matters depends on the reward for successfully completing the mini-game. If successfully completing the mini-game has any affect at all on other players, then I would consider cheating pretty important and go with option 1.

And note that "any affect" can be very subtle. Let's say that completing the mini-game just earns access to a new level for that one player. In that case, I wouldn't really care if they passed the mini-game by cheating. If however the mini-game earned them some visible trophy (eg. a badge on their profile) that other players can see then I would want to protect against cheating. And if the mini-game earned them a special weapon then I would definitely want to protect against cheating.

Answer 2

Recording all the player moves and sending them to the server, is a good choice.

If you wanted more cheat protection, you could even have a key that is generated each move, using a seeded random number generator, using the the time in milliseconds for each key. Verify the moves and verify that the moves were created validly.

This will prevent people from packet sniffing and trying to spoof the moves with a solver program.