2

I've been working on some Javascript/Canvas games and have been trying to come up with a way to store game state and data, an example of such data being high scores.

The simplest way to do this would of course be just to post the high score to a server with an http request, but that is so easy to fool, people could just make their own http request and voila, you are now the champion.

I'm asking stackoverflow if you have solutions to this problem. This is a tricky problem since the javascript code is running on the clients computer and it's human readable.

The only possible solution, or rather, deterrent, I've come up with is to obfuscate the javascript code that makes the high score post (and including a checksum / magic constant in there), at least makes the system harder to game.

Do you have any better ideas?

Valdemar
  • 950
  • 1
  • 12
  • 20
  • 1
    What would prevent the users from directly editing the JavaScript variable in the game? – Madara's Ghost Aug 11 '12 at 00:49
  • 1
    Insane suggestion: You could add up the score during gameplay with an [additively homomorphic cryptosystem](https://en.wikipedia.org/wiki/Homomorphic_encryption) with a private server-side key and public client-side key, and then verify the submitted value server-side at submission time. Even if you did that, though, there'd be nothing to stop an attacker from simply running your `addPointsToScore` function repeatedly. – apsillers Aug 11 '12 at 00:52
  • 1
    This question is asked a lot on SO. See for example http://stackoverflow.com/questions/7171101/prevent-cheating-on-javascript-game. I guess it is good to re-ask from time-to-time in case some new unknown technology pops up out of the blue. :) – Ray Toal Aug 11 '12 at 00:53

1 Answers1

3

In cases like these, the solution is not to save and not to transport the score anywhere.

Instead, calculate it on demand, and only cache it for display. When the high-score report is needed, pass in the multiple factors which affect the score, and encrypt them.

The server would then decrypt the message, and recalculate the score on its own.

Madara's Ghost
  • 172,118
  • 50
  • 264
  • 308