I have decided to begin working on some sort of leaderboard server for my PC game.
For starters, I decided to write some PHP scripts to handle it. The script doesn't actually receive a score - it just receives a player ID. Then the server increases their score. When submitting a "victory", the game performs a connection to the server of this form:
As you can see, the server just receives the player ID and then it does its own scoring stuff (the score value of a victory changes overtime).
My concern is pretty simple: what if some guy figures this out? They would be able to spam the above address several times and keep increasing their score.
- Don't accept victories from the same player within a short amount of time.
- Due to the nature of the game, players can have a victory as fast as within 1 minute. If somebody is having a victory every minute, I would not be able to tell whether they are cheating or just very good.
I have found an answer here: https://gamedev.stackexchange.com/a/4185/4779
- Send a JSON message over plain HTTP (not HTTPS). Include a MD5-hash of all fields plus a magic string.
- On the server, check the integrity of the message with the same operation.
But as far as I'm concerned, this doesn't quite work with my scenario because I am not really sending a score - just reporting a victory.