0
\$\begingroup\$

So, I have a game in Unity for mobiles that gives you the possibility to sign-up with username, email and password to unlock extra features. The datas are sent, through a POST request, to a PHP+MYSQL server that expose an API. I'm developing both so I have complete freedom on how to implement it.

My question is what is the correct way to:

  • save auth data on player mobile device so it can automatically login on subsequent runs of the game
  • how to safely send username and password to my server for the authentication

I want to protect data from man in the middle attacks and I don't want to send clear password because users tends to always use the same email/password combination.

Thank you

\$\endgroup\$
2
  • \$\begingroup\$ This is subjective. For the love of your players, though: transmit securely and don't store in plaintext. \$\endgroup\$ Commented Nov 18, 2014 at 16:54
  • \$\begingroup\$ I'm asking for the correct way to do this within Unity and towards a PHP API. \$\endgroup\$
    – Erik
    Commented Nov 18, 2014 at 17:15

1 Answer 1

3
\$\begingroup\$

You want your webserver access to go through HTTPS; that will encrypt the traffic so people in the middle can't read it.

\$\endgroup\$
4
  • \$\begingroup\$ Yes, but it requires me a Signed Certificate from a Third Party (not self signed) and I don't think that Unity is capable of generating an encrypted POST. Please don't give me general advices but specific implementation with Unity and PHP web server. Thank you \$\endgroup\$
    – Erik
    Commented Nov 18, 2014 at 17:14
  • 1
    \$\begingroup\$ You are vulnerable without HTTPS. I'm just calling it like it is. Implementing your own security would A) be insecure B) take a very long time. Our Unity game goes over HTTPS, and it works fine. As far as my personal projects, I'm at a webhost that does HTTPS for me. They do myproject.secure.hostcompany.com, and they have a shared certificate for secure.hostcompany.com that their subscribers can use without extra charge. \$\endgroup\$
    – Almo
    Commented Nov 18, 2014 at 17:57
  • \$\begingroup\$ Did using https with Unity in your iOS build give you problems with App Store approval? (they ask you you use encryption) \$\endgroup\$
    – Erik
    Commented Nov 18, 2014 at 19:23
  • \$\begingroup\$ No trouble with Apple at all. \$\endgroup\$
    – Almo
    Commented Nov 18, 2014 at 19:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .