I'm pretty new at making online games. Right now I'm trying to make an iPhone game. Each player has a profile in my server.
I want to avoid username/password for authentication. Currently, as it stands, when my game is installed it also generates an unique key string and safeguards it in the device. When the player runs the games and needs to perform an action, the action request is sent to the server - along with the key to validate the action.
This is done with an HTTP request, and is working fine.
The thing is, I'm not sure about the security implications behind this. Suppose that a seasoned cracker manages to discover their own key string (if it is stored somewhere in the device I imagine it is always possible to crack), and also identifies the HTTP request schema. They could technically create their own program, use the key string, and send requests to my server and effectively automate several tasks.
For example, let's say that you discover that your key string is
12345, and you also realize that the HTTP requests are like this
Well, now you're capable of making a nice program automating
So then I considered doing something like cookies. As if, the player authenticates using the key string and then the server returns some "session ID" which is stored in the device. The session ID must be used to validate actions. But I'd imagine this would cause the same issue: the cracker just discovers the session ID and off they go.