However you expose it, it always can be faked IMO... | [reply] |
Actually no. You can use a challenge/response technique. Take the MD5 hash of the current time plus some secret "seed", and send that to the client. Then, whenever the client requests that action, it must supply this MD5 hash. On the server side, you recalculate the hash for each of the last x seconds, and see if any matches what the client supplied. Only permit the action if the hash matches.
The trick is to only deliver a hash to the client when it is a valid time to perform the action. And by restricting x to a small number of seconds, you control fairly tightly when the action can take place. So even if they do fake it, they can only fake it when it's a valid time to perform the action anyway.
| [reply] |
Whatever seed you choose,you need to send it to the client, and a programmer can do faking using that seed...
| [reply] |
However you expose it, it always can be faked IMO...
Um, the solution is to NOT expose it
If its private data, only the server is supposed to modify, the solution is to only let the server modify it
I think you need to explain the architecture of your application, draw a plain ASCII diagram or flowchart
Think of the server as a bartender, who needs to check id, serve drinks, make change ... only bartender touches the cash register, customers always have to go through bartender, and he knows how to spot fake currency, fake ids, how much vodka is left ... bartender is gatekeeper
See The Architecture of Open Source Applications
| [reply] |
Don't you guys ever play web games??
It's impractical to send a request to the server side whenever you move/click your mouth....That will no doubt cause performance issue and no one will like to play your game...
| [reply] |