hi.

my question in general is: is it better to use something like session id to check data or its better to send and receive important authentication data like username and password or there will be no need to generate session id after authenticating the player or send and receive user pass after player logged in?

im working on a mmo game that data security is very important. first of all i use ssl to send and receive data so i think there will be no problem of understanding and hacking data in the net. there is an idea that when a player logged in there will be made an object of player class that contains player data that needs to be sent and received. after player logged in and query succeed, server generates a random number for session id variable and through data connection that session id will be sent and received and checked for player. another idea is just sending and receiving username and password in every packet and last option is just send and receive gameplay variables after logging the player. each one may have some volunrablities and problems. i want to know which one may you use for this kind of game.

thank you for helping.

Sending name + password in every packet/session leaves a little more surface area for leaking the data

thank you for answering my question. im trying to first encrypt my data and after that use hashing. but i think its very expensive for mobile processor to do it in every frame. i use ssl or maybe rsa for cryptography. ssl made some headache to code and still have some problems to work with sslStream but rsa is easy to code but i think its no good for my work. im just making a sample code to see how these cryptography algorithm on every frame. as its an asynch mmo game. i think its better to let server and client work seperately and check at some frames like every 60 frame. i just have to make code not to wait for process to show the frame. just when process of encrypting and decrypting finished just check data in that frame.

so i think as data is encrypted through network its hard to leak. but what you mean about having session id is usefull for support logging in a same time? you mean one user with same username can connect and play in same time with diffrent devices? and it makes distinguish and have diffrent socket connections for one username to change same data on database?