0
\$\begingroup\$

For my Unity WebGL game, I'm looking into storing the score of users in a database to make a highscore table (it's not a multiplayer game). Because client side code can always be "hacked", the advice most people give is: "keep the score server side so you can validate it". But I don't quite understand how that would work. I could of course publish the score to the server using an Ajax call, and even hash it, but even then the cheater could just simply look at the hash method and use the same Ajax to upload a different score.

I'm assuming I should get a game server or something then? But again: no idea on how to start... I'm really just scratching the surface here.

So I'm basically looking for any sort of information on how to change my "regular", client side, WebGL Unity game to a game where I keep the score securely at server side so that the highscore table is valid.

I don't mind spending some money on both a server/assets that simplify the task. As I said, I'm just interested in implementing this feature, I don't need to become a game server wizard.

Note: even with server side scores, there's probably a way to cheat. There most likely always is, but at least it would be more secure than just inserting the final score into the database...

Improve this question
\$\endgroup\$
4
  • \$\begingroup\$ It doesn't look like we have enough information about your game to tell you how to move the relevant parts to the server. We have no idea what contributes to gameplay and scoring. \$\endgroup\$
    – DMGregory ♦
    Jan 9, 2019 at 13:15
  • \$\begingroup\$ Thanks for your feedback. It's basically a first person shooter where people shoot enemies and receive point the faster they hit them. \$\endgroup\$
    – binoculars
    Jan 9, 2019 at 13:20
  • \$\begingroup\$ Possible duplicate: gamedev.stackexchange.com/questions/4181/… This question comes up quite often, have you searched around other people having similar concerns? Does something they ended up using not work in your case? If so it's useful to tell us what that is. \$\endgroup\$
    – Tom Tsagkatos
    Jan 9, 2019 at 13:24
  • \$\begingroup\$ Yes, I've searched around quite a bit. Some obfuscating techniques on the client side are often proposed, which is fine, but the conclusion always seems to be: "don't bother. Keep it server side or it can easily be hacked." The client side obfuscating methods I understand, it's just that I didn't find anywhere how to do the server side thing... \$\endgroup\$
    – binoculars
    Jan 9, 2019 at 13:33

1 Answer 1

Reset to default
1
\$\begingroup\$

Don't send scores. Send game events as they happen, and calculate the score that results from those game events.

The server can then validate whether the claimed sequence of game events is plausible, and reject implausible play, stopping it from recording a high score.

For instance, if your client & server can both agree on the same sequence of enemy movements, the client can send "I shoot in this direction" and the server can check "would that shot kill an enemy at the time the message was sent?" and increment the score if so.

There are various types of validation you can do, like verifying the player isn't claiming to move or aim faster than the game allows, or aiming through occluders like walls. Any rule violations tell you that you're communicating with a modded or spoofed client (or you have a sychronization / replication bug to sort out, where the client's game state isn't correctly matching the server's)

The one thing this strategy can't do is distinguish between a perfect player and a bot that plays by the rules, perfectly. For that the best you can do is look for telltale signs of human error, and analyze patterns to detect signs of a bot using randomness to fake human imperfection.

Improve this answer
\$\endgroup\$
6
  • \$\begingroup\$ I see, makes sense to send over game events to "a server". But how to do this? I could make Ajax calls to a PHP script on my web server and add the game events to my mysqli database, but I assume this would be way too slow and have a lot of delay. What would the best method be to send these things to the server? \$\endgroup\$
    – binoculars
    Jan 9, 2019 at 13:36
  • \$\begingroup\$ Since your server needs to do a lot of game logic to validate scores, it usually makes sense to build the server on the same tech stack as your game, so you know eg. the physics libraries will agree, and you don't need to author your weapon, level, & AI behaviour code & data twice. \$\endgroup\$
    – DMGregory ♦
    Jan 9, 2019 at 13:39
  • \$\begingroup\$ That's where you lost me :) . "build the server on the same tech stack"? \$\endgroup\$
    – binoculars
    Jan 9, 2019 at 13:40
  • \$\begingroup\$ In this example, your tech stack is the Unity engine. So your server is also a Unity game, just running headless. \$\endgroup\$
    – DMGregory ♦
    Jan 9, 2019 at 13:41
  • \$\begingroup\$ Still can't really wrap my head around it... I have no experience in game servers at all. Any concrete resources I could look into? \$\endgroup\$
    – binoculars
    Jan 9, 2019 at 13:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .