On backend I am using java. I have a game in HTML5; when user completes it I sends an Ajax call to save the score to database. Now, someone can easily use tools like Fiddler and firebug to modify this ajax request and send a much better score to the server. How do I make sure that user cannot manipulate scores !


5 Answers 5


Don't just send an integer score to the server. Send a collection of game stats that can be used to verify the score was realistic. Or you can implement some pre-shared key for calculating the score. You could send incremental scores and stats throughout the game and ensure that the increase is reasonable.

However, I wouldn't worry too much about it. The suggestions above will make it more difficult, but not impossible to send a fake score. However, if you just make it slightly difficult a vast majority of people that play your game will not be interested in trying to cheat it.

Do be careful about how you're allowing your game to communicate with your server. You don't want your game to be an entry point into your server for hacking. Make sure you always validate your input and never trust the client.

  • 7
    \$\begingroup\$ See programmers.stackexchange.com/questions/150127/… and gamedev.stackexchange.com/questions/37392/… to complete with the "Never trust the client" \$\endgroup\$
    – dievardump
    Commented Oct 15, 2012 at 17:04
  • \$\begingroup\$ @Byte56 no form of obfuscation or encryption will protect your code from a debugger being used to modify the game data during play. If the gameplay happens on the client, it's essentially impossible to prevent this form of cheating. A Javascript-enabled browser is not a trusted computing device. \$\endgroup\$
    – MarkR
    Commented Nov 9, 2012 at 7:15

As Byte56 said: "never trust the client", but:

Never trusting the client comes at a price:
Having all games being played on the server will increase your infrastructure cost a lot.

Assuming most of the players won't cheat
and the top highscore will settle after a little time and stop changing a lot

there is a middle way.

Record the games (on the client).
(Depending on the game type that might be super easy (e.g. chess) or a little complicated (e.g. a multiplayer FPS),
but it's always doable.)

When a player finishes a game just submit the score.
If the score is within a certain range at the top (e.g. top 1% or top 5)
request the recorded data from the player
and replay that game on the server.
If the scores match, accept the score.

This way you don't need any additional server side resources for most of the plays,
but can ensure the top scores are valid.

  • 2
    \$\begingroup\$ In other words, who cares if they cheat for anything other than the top scores (why would they do that anyway?) so those are the only ones you need to validate. \$\endgroup\$
    – jhocking
    Commented Aug 19, 2013 at 19:30

Reduce social motivation to cheat by e.g. using social leaderboards (cheating only makes you look good to a handful of friends, it doesn't spoil it for everyone).

Verify on server. Joel Poloney had a good write-up of techniques in Game Developer 2012 September "Scale Your Online Game"


Do not worry about it; protecting from all attacks is essentially impossible if you trust the client. If nobody uses Fiddler etc, to modify the AJAX request, they can simply fire up a JS debugger and modify your game data to give themselves 1000 lives, etc, or modify your code, or do 100 other things you haven't thought of.

I wrote such a game several years ago, and to the best of my knowledge, nobody cheated in this way. There was no prize, except having your name on the score table.


When you want to create a cheat-proof online game, you need to handle all game logic on the server. Everything that happens on the client-side can be controlled and manipulated by the user. There are techniques like encryption or obfuscation you can try, but in the end it's all just security through obscurity which can be circumvented by someone who is sufficiently determined.

Sure, a game which runs on the server is a lot more complicated to develop, requires a lot more resources server-sided and network latency is detrimental to the game experience (especially for fast-paced games), but it's the only way to effectively prevent the players from cheating.

  • \$\begingroup\$ Even that won't prevent all cheating -- just the obvious "yeah, i legit got a bazillion points" stuff. Since something has to run on the client, they end up with some control regardless. At the very least, any client -- particularly a web browser -- is scriptable. \$\endgroup\$
    – cHao
    Commented Aug 20, 2013 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .