We are creating a turn based multiplayer game in Unity where client data is sent to the server (SSL encrypted) using JSON to update player currency, gear, etc. We have hit a road block with client verification. We need to be able to verify the Client application is indeed the Client.

For example - to update player gold to 100, the client would send the following URL Request:

example.com/update.php?player_id=1&gold=100&session_id=1234asdf

What is to keep someone from calling that exact same address in a browser and changing 100 gold to 10000000?

Option 1:

Create session_id based on algorythm stored in client code to verify?

FAIL

When creating a mobile game in Unity for Android, users can easily download the APK and view the source and see the algorythm.

Option 2:

Create session_id on server and send to client for later use?

FAIL

A network packet sniffer can intercept session_id being sent back down to the client.

In both cases, the above URL can be modified with a spoofed session_id and player gold set to 10000000 instead of 100.

Are we stuck with TCP ports for all client / server communication or can we still use JSON? If so, how can we use it securely?

Thank you!!!

What is to keep someone from disassembling your client and sending the same 1mil gold request from Client itself?

Number One Rule:

never trust a client

The solution to your problem is to change protocol from:

Client: "I opened this chest and now I have 100 more gold"

Server: "Ok"

to something like:

Client: "I want to open this chest".

Server: "You succeeded. This chest contained a treasure. You now have 100 more gold".

Client: "Ok"

Thanks for your reponse! It is very helpufl.

To follow up, how do we trust the client when it asks to open the chest?

For example, in our game there are battles where the player battles the computer and then reports to the server success or failure. We can modify the reward logic (as you suggested) to all be server side; however, we still have to 'trust' the client's battle success or failure response. Any ideas?

Thanks again!

example.com/update.php?player_id=1&gold=100&session_id=1234asdf

$url = 'http://example.com/update.php?player_id=1&gold=100&session_id=1234asdf';
$url .= '&hash='.secret_hash($url);
print $url;