1
\$\begingroup\$

I currently use a server back end to verify my managed in app currency purchases and update the user's coin value.

But what's the best practice to then deal with "in game purchases" where players swap their coin for virtual goods such as power ups etc.

I just realised that if I do it in the app then potentially a hacker could just remove the code so that they can buy some coins once then just perpetually buy whatever virtual goods they want.

Should I let my server back end deal with this instead, which would definitely solve the problem. Is this the best practice?

\$\endgroup\$
6
  • \$\begingroup\$ "If I do it in the app then potentially a hacker could just remove the code so that they can buy some coins once then just perpetually buy whatever virtual goods they want." Yes, that's right. If that's a situation you care about, then it sounds like you have your answer: everything you do on the client can be hacked. What do you need from us? \$\endgroup\$ – DMGregory May 21 '18 at 15:46
  • \$\begingroup\$ @DMGregory Best practices. As this stuff is new to me I wasn't sure if there was some other away of achieving the same thing via the Google API's in the client alone. \$\endgroup\$ – Pixel May 21 '18 at 16:02
  • \$\begingroup\$ If the hacker can hack your code, can't they hack Google's too? \$\endgroup\$ – DMGregory May 21 '18 at 16:09
  • 1
    \$\begingroup\$ @DMGregory I dunno, that's why I'm asking. I thought Google might be quite sophisticated, or at least one would hope so ! I guess you're right. I've just been thinking that no matter how much security I might want to include, ultimately a hacker could just get my app to add 1000 of each power up if they wish regardless of if I deal with the powers ups on the server or not. So is there any point spending time writing the extra server code? Perhaps, weighing things up, I might as well just deal with the power ups on the client. I suppose the assumption is that most people aren't hackers. \$\endgroup\$ – Pixel May 21 '18 at 16:16
  • 1
    \$\begingroup\$ It depends — can the powerups owned by one player affect other players or shared channels like leaderboards? If so, you'll want your server to ensure player B's can't be impacted by player A's hacking. You can't save player A from themselves, but you can limit them from getting a leg up on non-cheating players. \$\endgroup\$ – DMGregory May 21 '18 at 16:21
1
\$\begingroup\$

I would prefer you to have the code executed on the server side. Then it would be less likely to be hacked.

\$\endgroup\$
3
  • 1
    \$\begingroup\$ I've just implemented server side virtual goods / in game currency exchange. It feels much nicer just separating the code from the client game application. And I have the comfort of knowing any potential hackers are more limited in what they can now do. \$\endgroup\$ – Pixel May 21 '18 at 20:48
  • 1
    \$\begingroup\$ Well, if you were to use a pre-compiled language, you have even better security against hackers. \$\endgroup\$ – Caleb Evans May 26 '18 at 5:42
  • \$\begingroup\$ good point. Maybe a C++ conversion is on the cards ! \$\endgroup\$ – Pixel May 26 '18 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.