Newbie question please - I am working on my own RPG, using Unreal Engine 4 and C++.

Regarding data formats - I figured I would just make HTTP Post requests to store the data as JSON in AWS's DynamoDB, are there any security considerations to avoid players somehow tampering with the APi request/response such as, modifying progress state or items state - how is data safety ensured when making server calls? Should I encrypt the game data and decrypt it on the client?

I only want to prevent "casual tampering", because obviously client decryption will never be 100% safe. I just don't want to make it super easy to figure out "if I modify this value here, my armor increases 1000%"

Thank you,

  • \$\begingroup\$ Why don't you use steam cloud saves? \$\endgroup\$
    – Vaillancourt
    Commented Feb 16, 2019 at 13:19
  • 1
    \$\begingroup\$ Perhaps they are not publishing exclusively to Steam? \$\endgroup\$
    – Ed Marty
    Commented Feb 16, 2019 at 15:46

1 Answer 1

  1. Use HTTPS
  2. Sign and/or encrypt the data with a key included in the app. This won’t stop somebody from modifying the app, but it will stop casual MITM attacks using a proxy server.
  3. If you want to get fancy, have your server perform game state validation. Make sure things don’t look astronomically out of place. Of course, players can just find the largest value your system won’t reject.
  4. Finally, and most importantly, just don’t care. As long as you are not making a freemium or online game, what does it matter if they want to have their own kind of fun, without disrupting others?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .