We have an app with several mini-games in it and in each a highscore can be achieved. The score gets submitted by requesting an endpoint and passing the score as a json in the body. How can we be sure that the client is sending us the correct score? Our current solutions:
- we're using wss, so man in the middle should be not possible
- the client can access the endpoint only after authenticating with his device (over gamesparks)
- at least on Android we're obfuscating the code
- we're saving each score in two different variables and comparing them before sending one of them
Is there anything more we can do to secure the game? It seems to be quite effective to just submit the player interactions and calculate the scores server-side, but that seems - because of our several completely different games - to complicated in our case. What is about creating a hash of the score and comparing it on the server?