0

I have built a game in HTML5 and a web form posts data to a server.

The scores in the game are calculated using Javascript, and the form posts the data to the server.

Won't this architecture be vulnerable to an attack, where the client can be modified, such that it posts rogue values instead of the calculated scores?

How can I prevent this from happening?

user1016313
  • 1,274
  • 2
  • 15
  • 26
  • Thanks for the answers, but I still have a doubt about this. Supposing the modified client posts data to the server as follows (its a speed typing test game). If he does a POST and posts a full score, as well as posts the text entered as the correct paragraph. How can I prevent this? – user1016313 Jun 18 '12 at 18:16

2 Answers2

3

To keep things short - you need to do all of your verification server-side. There no problem using client-side scripts to keep things looking good, but you cannot trust anything from the client.

Take Stackoverflow as an example. When you vote it is instantly calculated client-side (to keep things nice and quick) but it is properly validated by the server once submitted.

For example if I attempt to upvote my own answer the server rejects it with the following JSON:

{"Success":false,"Warning":false,"NewScore":0,"Message":"You can't vote for your own post.","Refresh":false}

even though the javascript happily submitted it.

Therefore you also need to calculate your game scores server-side.

m.edmondson
  • 30,382
  • 27
  • 123
  • 206
0

Don't trust user inputs, especially trough a form they might perform SQL injection as you send data to your server. (see also How can I prevent SQL injection in PHP?)

Try to verify as much data as possible server side.

Seeing that you also use javascript watch out for javascript injection (http://www.testingsecurity.com/how-to-test/injection-vulnerabilities/Javascript-Injection) as they can inject changes into ur script (e.g. score value)

Community
  • 1
  • 1
Gooey
  • 4,740
  • 10
  • 42
  • 76
  • 1
    You need to verify everything server side (not just as much as possible). – m.edmondson Jun 18 '12 at 16:53
  • That is as much as possible imo, but not every thing can be verified. At most checked for certain criteria – Gooey Jun 19 '12 at 18:47
  • Checking criteria is *validation* **not** *verification*. See the [difference here](http://www.matthewedmondson.info/2010/08/difference-between-validation-and.html) – m.edmondson Jul 16 '12 at 14:55