8

After the user authenticated itself to the loginserver, give it a token (an unique, randomly-generated string too long to be guessed). The loginserver picks a gameserver. Send the token, the username and all other relevant data about the user from the loginserver to the server it picked. Send the token and the hostname of the gameserver to the client. Then ...


3

I cannot speak to how those games in particular work, but I have worked on other games that behave similarly. Quite simply, the client generates an anonymous id and password for you, similar to any normal profile creation, just without user input. That info is stored on the device. On iOS, it is possible for that data to be saved in the Keychain, where it ...


3

Your process is generally the right idea for a basic, generic multi player game without any specific design goals. However, there is a lot of stuff you should keep in mind that the client/server does not need to be doing. I'm going to list your steps again and annotate them. Client sends "iwanttologinwithcharacterx" Yes, this is an obviously needed step. ...


3

TCP does not guarantee message authenticity, it only guarantees that all messages are received and that they are received in the order they were sent. If you want to be sure the messages originate from the source you expected you can use Diffie-Hellman key exchange to establish a key. You can then use that key to encrypt all further messages using AES or ...


3

You want your webserver access to go through HTTPS; that will encrypt the traffic so people in the middle can't read it.


3

Edit: After posting this I realized it's almost the exact same answer given by Ali.S (slightly different but the overall approach is the same.) It started out as something completely different though. This method assumes that all communications are being held over a series of secure tunnels. How you achieve this doesn't matter. I would suggest TLS, but that'...


3

Although Philipp's answer is perfectly good, there is a slightly different way that does not require a connection between the login server and the game server, which is useful if such a connection is difficult. When the user authenticates successfully on the login server, they are sent a game server address and a login token as above. However this token ...


2

The client should have a private and a public key. The private key should be what the unique identifier that the client receives from the authentication server. The public key should be also sent to the client. Before the client connects to a game server, it should send a message with its private key and the ip of the game server it wants to connect to, ...


2

Don’t. You cannot secure your password indefinitely. What you can do is restrict access remotely. I don’t know anything about trello, but if it allows multiple logins with multiple permissions, you could create a user with more restrictive permissions and include those credentials in the game. Another alternative, if this is not supported, is to make a ...


2

For my game LowDown: A Social Experiment, I did this: The first time a user submits a number to a contest, there's a CAPTCHA to filter out bots. The server assigns the user a UserID, which is just the next index in the database table. It also assigns an invisible password (I call this a key; it's a randomly generated string). The client saves both the ID ...


1

Is copying the file too much to expect from users who want to switch computers? Not really. Well, it could be for younger less tech savvy players. Regardless, you want to make it easy. The user might not know what files to copy or where to find them. Have an export and import feature. If I understand correctly, this is not only for the world, but also for ...


1

The way I would do this is by having Auth server send token to Client after login along with list of validated Game servers (so that the Client can be sure the Game server is valid). Then the Client would send the token to the Game server, which would then send it to Auth server to confirm that this is the valid client. Login: Client to Auth server: ...


1

Definitely do not need a database. You can store this information in a text file, or the PlayerPrefs. The app would keep a list of player account names and passwords, and when a user tries to log in, search for the combination in the list. https://docs.unity3d.com/ScriptReference/PlayerPrefs.html


1

1.) This scenario seems possible, as there also exist private servers of some MMOs. 2.) I don't think that this could cause much harm. The important data for your game are on the Server. So they won't affect anything in the Online experience of other Players. Datamining will probably always exist in games. To prevent story leaks you could stream Texts from ...


1

When you have a multiplayer game, then any calculations which happen on the client can be controlled by the client in order to cheat. So you should think carefully about which game mechanics should be client-sided and which mechanics should be server-sided. I am imagining a user sending the client his/her own custom information about where to spawn ...


1

If you trust Steam to be secure enough that users can't add games to their account without actually purchasing them (which, let's be honest, if they could, Steam probably has waaay bigger problems than just that), then you could just query their Steam account. Method 1: OpenID Upsides: No Steam binaries to bundle. Potentially no need to take the users ...


1

afaik unity isn't currently capable of running on microsoft's own .NET framework, but rather uses mono an open clone of .NET The version number you mentioned is the mono runtime version. That version is roughly compatible with .NET 3.5 Whether or not you can run JWT will thus depend on whether you can compile and run the library you need on mono. if ...


1

There are multiple solutions that I can think of, but here is the most secure one: client connect to server. client requests an authentication bridge. server connects to auth server, acting as a proxy between player and auth. server. client and auth server, form an SSL session over this newly formed bridge. using this secure connection over bridge, client ...


1

Always downloaded from the server. If the private key is compromised then you can easily create a new one. If you're worried about load when the game gets popular, you can monetize your website or sell your game to pay for server upgrade/rent.


Only top voted, non community-wiki answers of a minimum length are eligible