views:

49

answers:

2

I have coded a basic game in JavaScript and am working on a high score system for it, however as it is coded in JavaScript we all know it is incredibly easy to open Firebug or Chrome's Dev tools and edit the code. For example adding a multiplier to the score.

Does anyone know either A) a way to check the JavaScript hasn't been modified and/or B) a secure way to post the scores

+4  A: 

There is nothing you can do. The script itself would be responsible for checking, and so can not be trusted.

Generally, people decide either to a) not care enough, and remove obviously fake high scores if they appear, b) log on the server-side how long the user was on the page before submitting to see if it was reasonable, or c) take the more arduous path of logging all game actions, sending those, and replaying the game on the server (probably in combination with option B).

However, those protect on a very basic level. To some extent, all you can do is make it not worth one's while to attack you; you can't ever prevent it entirely.

Matchu
+1 for a nice summary of the problem...
Justin Ethier
Pez Cuckow
Forgot to mention I'm also including a md5 hash to validate, where the hash is generated in obfuscated javascript (just to add another layer).
Pez Cuckow
+2  A: 

If practical, you could keep track of events that occur in the game, and then send them along with the score back to the server for verification. If the score of all "events" does not match with the score you received, you know it is invalid. If you really want you could even send the events as they occur, and periodically validate the score.

Alternatively you could even use the server to compute the score, and remove that logic from the JavaScript. But a client could still fudge the "events" it sends you.

Of course this does not make your application truly secure, only harder to break.

Justin Ethier
+1, I was going to suggest something similar, perhaps with a timestamp on each event and a server-side check to see if the timestamp differences are realistic. As you say, though, nothing is definite and JavaScript is not ideal for these things.
Andy E