So I have a web application game that runs completely on the client side and just returns the score back to the server to list the highest scorer. Now I have noticed that I can easily manipulate the scores via accessing the variables from the console and injecting my own value! This SUCKS! I am a total noob in this kinda development and have absolutely no clue how I can stop this apart from obfuscating the code and praying to god that the hacker doesn't figure out which variable is he supposed to use! Now I was hoping there are better ways to stop the hacker to gain access of my variables. Could someone help me out with this issue!?


Google for "javascript obfuscation". This will muddy your code up for when you deploy it. It will change your identifiers to more cryptic things so people will not be able to deduce what the score variable is called unless they monitor all the variables while running the game. Javascript's at a disadvantage since the code is directly readable by the user. Technically people can decompile Flash and read the bytecodes, but that's more work in general.

The real problem lies in when you submit the score to the server. Assume the client side can not be trusted at all regardless of the technology you used to create the game. Eventually data needs to come out of the game in the form of an HTTP request that can be easily viewed and modified. Look at this StackOverflow question. When people submit scores, you need to be smart about accepting and validating them.

Don't worry about this stuff until your game is robust and popular enough to warrant the concern. You'll need to analyze the relationships between player and game events and theoretically possible scores in order to make an effective anti-cheat system.

| improve this answer | |
  • \$\begingroup\$ That was a great answer! Thanks, I think I will have to do some stuff to deal with my game issue... This project just keeps getting more and more interesting every day.. :) \$\endgroup\$ – Shouvik Dec 17 '10 at 9:39
  • 3
    \$\begingroup\$ De-obfuscating JavaScript is trivial, and renaming identifiers won't stop anyone with a decent debugging tool. People crack this stuff all the time in compiled native binaries, it's an order of magnitude easier in JavaScript, even when "obfuscated". \$\endgroup\$ – user744 Dec 17 '10 at 11:31
  • \$\begingroup\$ +1 ^ Should have clarified that in my answer. \$\endgroup\$ – michael.bartnett Dec 20 '10 at 0:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.