I'm doing a simple idle game, HTML5 client and Node.js server, but I'm making it online, where the client talks to the server (websockets) and all the logic is in the server (I want to prevent cheating as much as possible, because I want to have leaderboards).
My idea is, when the player X attacks the mob Y and it hits for 10 (should gain 10xp), so I send that via websocket, "playerX|10". How do I validate the input, so that a cheater can't just send "playerX|100000000".
Also how do I handle mob deaths? Do I send a "playerX,mobY" and the server replies with a drop?
Am I worrying too much about security? The golden rule is never trust the client, but how?
I'm thinking maybe all the client does is send actions?
message: attack|mobY, and the server calculates everything, xp gains, hit values, but I still don't know how to handle mob death, without having to keep state for the current "fight" with that mobY.
Sorry if I'm not clear enough. If you can share some thoughts or articles about this stuff, I'll be very glad!